Firefox 154 / ESR 140.14: 4 Use-After-Free CVSS 9.8 — Thunderbird Too

On August 18, 2026, Mozilla shipped a batch of fixes covering four use-after-free flaws rated CVSS 9.8, spread across four distinct engine components: WebAssembly, text rendering, the image library, and the DOM core.

The most overlooked part of this batch isn't Firefox — it's Thunderbird. All four CVEs affect it too, because it shares Firefox's rendering engine. And a mail client that renders third-party HTML has a materially different risk profile from a browser, where the user chooses which pages to visit.

Patched versions: Firefox 154, ESR 153.1, ESR 140.14, ESR 115.39, and Thunderbird 154 / 153.1 / 140.14.

The Four CVEs

Shared vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

All four are use-after-free bugs: an object is freed while a pointer to it stays live. If an attacker controls what gets reallocated at that address, they steer program execution. It's the most-exploited bug class in browsers, precisely because it lends itself well to heap manipulation from JavaScript.

A note on the score

The NVD vector says UI:N — no user interaction. That's surprising for flaws sitting in a rendering engine: in practice, exploitation requires the malicious content to be loaded, so a page visited or a message displayed. That scoring choice is what pushes the score to 9.8 rather than the ~8.8 typical of browser CVEs.

The discrepancy changes nothing about what you should do — update — but it's worth knowing if you triage your backlog by score: these four will sort above comparable browser CVEs purely because of a scoring difference.

Why Thunderbird Changes the Nature of the Risk

Firefox and Thunderbird share Gecko. All four CVEs are therefore fixed in both products — but their exploitability differs.

In a browser, the user decides where to go. In a mail client, the content arrives on its own. Two of the four are particularly relevant:

• CVE-2026-74943 (Graphics: ImageLib) — image decoding. An email carrying a booby-trapped image reaches the vulnerable code as soon as the message is displayed.
• CVE-2026-74940 (Graphics: Text) — text, hence font, rendering. Same logic.

Depending on preview-pane configuration and remote content loading, the surface approaches zero-click exposure: the message merely needs to be rendered. That's why a Thunderbird fix should not be treated as less urgent than a Firefox one — it's often the other way round.

A concrete Thunderbird recommendation, independent of these CVEs:

Settings → Privacy & Security
  → uncheck "Allow remote content in messages"

It doesn't fix the flaws, but it substantially reduces what gets decoded automatically on receipt.

Products and Versions

Two of the four CVEs don't reach back to ESR 115. That branch is still maintained for older operating systems (Windows and macOS releases past mainstream support) and it still turns up in fleets constrained by hardware or line-of-business applications. If you run it, 115.39 covers you for two of the four — but the real question is how much longer you'll stay on an end-of-life branch.

Check your installed version:

about:support

Or from the command line on a Linux fleet:

firefox --version
thunderbird --version

On Windows, for a remote inventory:

Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe" |
  Select-Object @{N='Version';E={$_.VersionInfo.ProductVersion}}

Exploitation and Impact

What an attacker gains

A use-after-free exploited in the content process first yields code execution in the renderer, which is sandboxed. That isn't the end of the chain, but it's already substantial:

• Reading the compromised tab's content, including typed input
• Theft of cookies and session tokens accessible to that origin
• Access to the site's local storage

To go further, the attacker must chain a sandbox escape — a pattern we documented recently in another browser, where a use-after-free in Chrome allowed exactly that crossing from an already-compromised renderer. This is the standard browser exploitation model: a memory primitive in content, then an escape.

On Thunderbird

The calculus changes, because the entry vector is an email. An attacker doesn't need to lure the victim to a website: they send a message. In a targeted-attack context, that's markedly more reliable than a link-based phishing campaign, and it leaves no trace of a visit to attacker infrastructure.

Detection

There is no useful client-side IOC for a use-after-free — exploitation leaves no signature in browser logs. So the useful control is inventory, not detection:

# Windows — enumerate Firefox and Thunderbird versions across the fleet
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like "*Firefox*" -or $_.Name -like "*Thunderbird*" } |
  Select-Object Name, Version

Network-side, post-exploitation signals remain the classic ones:

• Outbound traffic from the browser process to destinations unrelated to browsing
• Valid sessions reused from an unusual IP or agent (visible on the application server side, not the client)
• Extensions appearing without user action

Mitigation

1. Update, and verify it actually applied

Firefox auto-updates, but the fix only takes effect after the browser restarts. That's the classic enterprise leak: endpoints sit on a vulnerable version for weeks because nobody ever closes their browser.

On a managed fleet, force the restart rather than relying on goodwill:

# Firefox GPO
Computer Configuration → Administrative Templates → Mozilla → Firefox
  → "Days before forced restart after update"

2. Don't leave Thunderbird out of the rollout

Thunderbird is routinely absent from update policies because it isn't perceived as exposed. Given the above, it should sit at the same priority as Firefox, if not higher.

3. Reduce automatically decoded content

Disable remote content loading in Thunderbird, and if your context allows, plain-text reading for external senders.

4. Review ESR branches still in service

If part of your fleet runs ESR 115, use this batch as the prompt to plan the exit. Two of today's four CVEs don't affect it, which is good news this time — but an end-of-life branch eventually receives one fix fewer than the others.

Why Continuous Monitoring of Browsers and Mail Clients Matters

Firefox and Thunderbird receive several critical CVEs per month, and the window between disclosure and a working exploit is measured in days for this bug class. The problem isn't knowing about the CVE — Mozilla communicates clearly — it's knowing which versions actually run across your fleet the moment the fix lands. Without that inventory, "am I exposed?" takes days to answer, during which the answer is probably yes.

With cveo.tech, inventory the browsers and mail clients deployed across your fleet and get automatic alerts whenever a critical CVE targets one of your exact versions — so the update campaign starts on publication day, not three weeks later.