Firefox and Thunderbird WebAssembly Use-After-Free Vulnerability

Technical Analysis

CVE-2026-74936 is a use-after-free (UAF) vulnerability in the WebAssembly component of Firefox's JavaScript engine, which can lead to memory corruption when an object is accessed after being freed. Given the 9.8 CVSS score, this flaw is likely exploitable for remote code execution via a crafted web page or malicious WebAssembly module, requiring minimal user interaction (e.g., visiting a malicious site). The vulnerability affects both Firefox and Thunderbird across standard, ESR 140.x, and ESR 153.x release lines, indicating the flaw exists in a shared core component. Exploitation could allow attackers to execute arbitrary code in the context of the browser or mail client, potentially leading to full system compromise. AI agent systems that use headless Firefox instances or Firefox-based browser automation (e.g., for web scraping, RAG data collection, or agentic browsing tasks) are directly exposed, as a malicious or compromised web page could trigger RCE within the agent's execution environment, potentially exfiltrating API keys or pivoting to the host system.

Affected Systems

Firefox versions prior to 154; Firefox ESR versions prior to 140.14; Firefox ESR versions prior to 153.1; Thunderbird versions prior to 154; Thunderbird versions prior to 140.14; Thunderbird versions prior to 153.1

Indicators of Compromise

• No specific IOCs published at this time; exploitation indicators would include unexpected browser/Thunderbird crashes, anomalous WebAssembly execution, or unexplained process injection within firefox.exe/thunderbird.exe processes

Remediation Steps

1. 1

   Update Firefox

   Immediately update all Firefox installations to version 154 or later, or to the appropriate ESR version (140.14 or 153.1).

2. 2

   Update Thunderbird

   Immediately update all Thunderbird installations to version 154, 140.14, or 153.1.

3. 3

   Patch automated browser environments

   Update any headless or automated Firefox instances used in CI/CD pipelines, web scraping tools, or AI agent browsing frameworks (e.g., Selenium, Playwright with Firefox/Gecko drivers).

4. 4

   Restrict WebAssembly execution

   Where feasible, disable or restrict WebAssembly execution in high-risk automated or agent-driven browsing contexts until patching is confirmed.

5. 5

   Monitor for exploitation

   Deploy endpoint detection to monitor for anomalous browser process behavior, unexpected memory access patterns, or crash reports consistent with UAF exploitation.

6. 6

   Rotate exposed credentials

   If agent systems using vulnerable Firefox instances handled sensitive credentials or API keys, rotate them as a precaution following patching.