{
  "cveId": "CVE-2026-74951",
  "url": "https://patchblox.com/security/cve/CVE-2026-74951",
  "summary": "CVE-2026-74951 is fixed in MozillaFirefox on 1 platform, first by SUSE-SU-2026:3658-1, released August 20, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "MozillaFirefox: This update for MozillaFirefox fixes the following issues:\n\nUpdate to Firefox Extended Support Release 140.14.0 ESR....",
  "description": "This update for MozillaFirefox fixes the following issues:\n\nUpdate to Firefox Extended Support Release 140.14.0 ESR.\n  \n- MFSA 2026-74 (bsc#1274867)\n  - CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component.\n  - CVE-2026-74935: Privilege escalation in the DOM: Networking component.\n  - CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component.\n  - CVE-2026-74937: Use-after-free in the JavaScript: GC component.\n  - CVE-2026-74938: Mitigation bypass in the JavaScript: GC component.\n  - CVE-2026-74939: Privilege escalation in the DOM: Navigation component.\n  - CVE-2026-74940: Use-after-free in the Graphics: Text component.\n  - CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component.\n  - CVE-2026-74942: Privilege escalation in the Remote Settings Client component.\n  - CVE-2026-74943: Use-after-free in the Graphics: ImageLib component.\n  - CVE-2026-74944: Use-after-free in the DOM: Core \u0026 HTML component.\n  - CVE-2026-74945: Information disclosure in the Graphics: Text component.\n  - CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n  - CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component.\n  - CVE-2026-74948: Information disclosure in the Graphics component.\n  - CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.\n  - CVE-2026-74950: Privilege escalation in the Downloads API component.\n  - CVE-2026-74951: Clickjacking issue in Firefox for Android.\n  - CVE-2026-74952: Privilege escalation in the Application Update component.\n  - CVE-2026-74953: Privilege escalation in the Networking: Cookies component.\n  - CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component.\n  - CVE-2026-74955: Privilege escalation in the Request Handling component.\n  - CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component.\n  - CVE-2026-74957: Mitigation bypass in the Safe Browsing component.\n  - CVE-2026-74958: Information disclosure in the WebRTC component.\n  - CVE-2026-74959: Mitigation bypass in the Storage: Cache API component.\n  - CVE-2026-74960: Site isolation issue in the WebExtensions component.\n  - CVE-2026-74961: Side-channel in the Web Audio component.\n  - CVE-2026-74962: Site isolation issue in the Networking: Cookies component.\n  - CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component.\n  - CVE-2026-74964: Integer overflow in the Graphics component.\n  - CVE-2026-74965: Privilege escalation in the Shell Integration component.\n  - CVE-2026-74966: Information disclosure in the Form Autofill component.\n  - CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component.\n  - CVE-2026-74968: Site isolation issue in the Graphics: WebRender component.\n  - CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component.\n  - CVE-2026-74970: Site isolation issue in the Graphics component.\n  - CVE-2026-74971: Information disclosure in the DOM: UI Events \u0026 Focus Handling component.\n  - CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component.\n  - CVE-2026-74973: Race condition, use-after-free in the Graphics component.\n  - CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component.\n  - CVE-2026-74975: Spoofing issue in the Downloads component in Firefox for Android.\n  - CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component.\n  - CVE-2026-74977: Integer overflow in the Graphics component.\n  - CVE-2026-74978: Clickjacking issue in the Widget component.\n  - CVE-2026-74979: Mitigation bypass in the Add-ons Manager component.\n  - CVE-2026-74980: Clickjacking issue in the Downloads component in Firefox for Android.\n  - CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component.\n  - CVE-2026-74982: Denial-of-service in the Widget component.\n  - CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component.\n  - CVE-2026-74984: Race condition in the JavaScript Engine component.\n  - CVE-2026-74985: Privilege escalation in the Enterprise Policies component.\n  - CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component.\n  - CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154.\n  - CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154.\n  - CVE-2026-74989: Internally found bugs fixed in Firefox 154.\n  - CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and\n    Firefox 154.\n  - CVE-2026-75874: Sandbox escape in the Remote Settings Client component.",
  "published": "2026-08-20T17:16:18Z",
  "severity": "",
  "epss": 0.00275,
  "epssPercentile": 0.20074,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "MozillaFirefox",
      "release": "sles 15.6",
      "fixedVersion": "140.14.0-150200.152.251.1",
      "fix": "SUSE-SU-2026:3658-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3658-1",
      "released": "2026-08-20T17:16:18Z"
    },
    {
      "platform": "linux",
      "product": "MozillaFirefox",
      "release": "sles 15.7",
      "fixedVersion": "140.14.0-150200.152.251.1",
      "fix": "SUSE-SU-2026:3658-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3658-1",
      "released": "2026-08-20T17:16:18Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T20:03:11Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}