Do This Now

A page can walk out of Firefox’s sandbox. Version 154 closes it

Lapain Epuran
Lapain Epuran22 Aug 2026, 02:49 · 7 min read

Firefox keeps a fence around a tab so a nasty page cannot reach the rest of the profile. On 18 August 2026 Mozilla shipped Firefox 154 and closed a high-severity sandbox escape in the Remote Settings Client, the piece that pulls Firefox’s own configuration. A page that cracks that fence can step outside the tab and see the session you already unlocked. Open Help, then About Firefox. Wait until the number reads 154. Restart.

Firefox showing a fake Your Firefox is not secure scare page
A page can crack the browser.

Overview

What broke

Mozilla’s Firefox 154 advisory, MFSA 2026-74, leads with CVE-2026-75874: a sandbox escape in the Remote Settings Client. Mozilla rated it high. Remote Settings is how Firefox fetches settings, blocklists, and other configuration from Mozilla. A sandbox is the cage around a tab. An escape means code that should have stayed in that cage can walk out into the rest of the browser, where the cookies, the password door, and the other tabs already live.

The same bulletin stacks other high bugs on the same restart: a site isolation hole in WebGL, privilege escalation in DOM networking, and use-after-free bugs in WebAssembly and the JavaScript garbage collector. A use-after-free is when Firefox frees a chunk of memory and then writes to it anyway. Those extra bytes can become instructions. One About screen covers the set.

Mozilla also closed internally found memory corruption that they say could be exploited with enough effort. Those sit in four bucket CVEs, not one hole. CVE-2026-74987 is the internal-bugs bucket for Firefox ESR 140.14, Firefox ESR 153.1, and Firefox 154. It is not the sandbox escape. CVE-2026-74988 covers ESR 153.1 and 154. CVE-2026-74989 is Firefox 154 only. It does not land on the ESR trains. CVE-2026-74990 is the wide one: ESR 115.39, ESR 140.14, ESR 153.1, and Firefox 154.

Mozilla has not said 75874 is being used in the wild. CISA has not added it to the Known Exploited Vulnerabilities catalog. The patch is out. That is the window.

Who is in range

Anyone still launching Firefox below 154 on Windows, Mac, or Linux. Android Firefox below 154 is in the same train. Mozilla posted Firefox for Android 154.0 on 18 August with the security fixes. A desktop restart does not patch the phone.

ESR shops are in range until About shows the August ESR build for their train: 153.1, 140.14, or 115.39. The sandbox escape itself is a Firefox 154 fix. The ESR builds still close the other high bugs on those trains, including the 74987, 74988, and 74990 buckets that actually land there.

Thunderbird shares the same Remote Settings guts. Mozilla’s Thunderbird 154 advisory, MFSA 2026-78, lists 75874 as well. Thunderbird 153.1 and Thunderbird 140.14 shipped the same day. They do not list the sandbox escape. Take 154 on release Thunderbird. Take 153.1 or 140.14 on the ESR mail client.

If you “don’t use Firefox” but never uninstalled it, that copy is still in range. A shop PC with Firefox pinned as the company browser is in range until About shows 154. Chrome-only and Safari-only households can skip this tab. Updating Chrome does not patch Firefox.

What the vendor shipped

  • Firefox 154 (18 August 2026), the build that closes 75874
  • Firefox for Android 154.0, same day
  • Firefox ESR 153.1, 140.14, and 115.39
  • Thunderbird 154, plus Thunderbird 153.1 and 140.14 for the ESR mail trains

The cards are MFSA 2026-74 for Firefox 154 and the matching 18 August ESR and Thunderbird advisories. The in-app path is Help, About Firefox. On a Mac it is Firefox, About Firefox. Firefox downloads the build itself. You wait, then Restart. Android comes from Google Play. A shop image frozen by policy will not self-update until whoever owns the image allows 154.

What this is not

  • Not CVE-2026-74987. That number is an internal-bugs bucket. The sandbox escape is 75874.
  • Not an ESR-train fix for 75874. Firefox 154 closes the escape. 74989 also stays on 154.
  • Not on CISA KEV. Mozilla has not said it is in the wild.
  • Not patched by updating Chrome or Edge. Different browser, different installer.
Do This Now card: Relaunch Firefox 154, in range You, urgency Today, then About Firefox
Relaunch Firefox 154.

Do This Now

In range: You. Anyone still on Firefox 153 or older, including the ESR trains below the August builds, plus Android Firefox below 154.

Urgency: Today. Mozilla rated the sandbox escape high. They have not said it is in the wild. The patch is out.

  1. In Firefox: Help, About Firefox. Wait until it shows 154, then Restart.
  2. ESR shops: take 153.1, 140.14, or 115.39, whichever train you are on.
  3. On the phone: store, update Firefox, then swipe it away and reopen it. If you run Thunderbird, Help, About Thunderbird, and take 154 on the release channel.

Who can skip

  • About Firefox already shows 154 or newer.
  • Your ESR build already shows 153.1, 140.14, or 115.39, and you have no release Firefox that anyone clicks.
  • Android Firefox already shows 154, and there is no desktop copy in the house.
  • Chrome-only or Safari-only, and you have confirmed Firefox is not installed, skip this tab.
  • A shop PC whose Firefox is frozen by policy cannot self-update. That is an IT push of 154, or the matching ESR build, not a skip for the fleet.

Why it matters

Firefox holds the session you already logged into: mail, the bank tab, the password door, the shop’s admin console. The sandbox is the fence that is supposed to keep a bad tab away from that pile. A sandbox escape in Remote Settings is how a nasty page stops being a tab and starts being the browser. You do not need a second exploit story for that to be worth a restart.

Mozilla did not put an exploited flag on 75874. CISA has not added it to KEV. Waiting is still how a high bug sits on the browser you click through every morning. The About page is already in the Help menu. The download is Mozilla’s own updater, not a third-party “browser update” site.

The other machines are the easy miss. The laptop in the bag, the shop front-desk PC, the Android phone that only opens one bookmark: each one is its own About screen or store tap. Updating the desktop does not patch the phone. Updating release Firefox does not move an ESR image. One stale copy is enough.

The bottom line

On the PC

  1. Open Firefox. Any tab is fine. You do not need a special page.
  2. On Windows or Linux, open Help and click About Firefox. On a Mac, open the Firefox menu and click About Firefox. Some builds hide Help behind the hamburger button in the top right.
  3. The About page is a real Firefox tab. It will say Firefox and a version number, then start checking.
  4. Let it download. The line you want on the release channel is 154 or a later 154 build. If it still shows 153, stay on the page until 154 arrives.
  5. Click Restart when the button appears. Firefox will close every window and reopen them. That is expected. If there is no Restart button and the number is already 154, you are done on this PC.
  6. Open About one more time after the restart and read the number. Do not trust the splash. Trust the About line.

If About Firefox never moves

Quit Firefox fully. On Windows, check the system tray and Task Manager for leftover Firefox processes, then reopen Firefox and try About again. A download that sits at 0% is often a proxy or a shop policy. Use the network you already trust. Do not download Firefox from a random “browser update” site. Mozilla’s own About page is the installer. If you must fetch a package by hand, use Mozilla’s Firefox download page.

A shop PC with Firefox managed by Group Policy, an MDM catalog, or a “do not update” image will not self-update no matter how many times you open About. Ask whoever owns the image to push Firefox 154, or the matching ESR build if that is the train on the machine.

On the phone, ESR, and Thunderbird

  1. Android: Google Play, Firefox, Update. Swipe the app away and open it once. About should show 154 or newer.
  2. ESR: Help, About Firefox. Take 153.1, 140.14, or 115.39 for your train. Do not jump an ESR shop to 154 unless that is the plan. 75874 is a 154 fix. The ESR builds still close the August bugs that land on those trains.
  3. Thunderbird: Help, About Thunderbird. Take 154 on release, or 153.1 / 140.14 on ESR mail. 75874 is in Thunderbird 154, not on those ESR mail builds.
  4. The laptop in the bag and the shop front-desk PC: same Help, About Firefox path tonight.

What you should see

On the About tab, under the Firefox heading, the version starts with 154. If you still see 153 or an older major, stay on the page. After Restart, the same About tab should show 154 without asking again. ESR About will say 153.1, 140.14, or 115.39. Android About lives in the app’s Settings, About Firefox. You want 154 there too.

When you are done

Desktop About reads 154 or newer on release Firefox, or the August ESR build on an ESR machine. Android About reads 154, and the app has been swiped away once. Thunderbird, if you use it, reads 154 on release or 153.1 / 140.14 on ESR. Chrome and Edge are separate clicks. You do not need to clear history or sign out. You needed a new build. You have it.

Send this to someone