Firefox 154 fixes a sandbox escape, WebAssembly flaws and broad memory-safety risks
Mozilla released Firefox 154 and new ESR builds with a substantial security package. We explain the major CVEs, enterprise exposure and rollout priorities.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 18 August 2026
- READING TIME
- 16 min read
- TOPIC
- Vulnerabilities and CVEs
Mozilla released Firefox 154 on 18 August 2026 with an extensive security advisory. The update closes a Remote Settings Client sandbox escape, CanvasWebGL site-isolation weaknesses, DOM privilege escalations and multiple use-after-free defects in WebAssembly, JavaScript garbage collection, graphics, ImageLib and the DOM core. Supported ESR 153.1, 140.14 and 115.39 lines received the relevant subsets in parallel.
This is not a bulletin about one magical zero-day. It repairs many browser boundaries: content processes, graphics, JavaScript memory management, remote configuration, the same-origin policy and system APIs. Mozilla’s advisory does not identify active exploitation. The update is nevertheless a priority because of the number of exposed components, constant contact with untrusted web content and the possibility of combining defects into a chain.
CVE-2026-75874: escaping the Remote Settings sandbox
CVE-2026-75874 has a high impact rating and the description “sandbox escape in the Remote Settings Client component.” Remote Settings supplies Firefox with remotely managed configuration data, including lists and settings used by security features. A component closer to privileged browser services becomes a valuable second target if an attacker first obtains execution inside a restricted process.
A sandbox escape is not always a standalone internet entry point. It commonly forms stage two: the first vulnerability compromises a renderer or content process, and the second breaks its restrictions. Administrators should not dismiss it because an attacker may need prior code execution in the sandbox. The very purpose of modern browser isolation is to stop one renderer bug from exposing the entire profile and operating system.
Mozilla does not publish a complete exploit or chain on the advisory page. A defensive team should deploy the update rather than trying to reproduce behaviour on production endpoints. Safe validation checks the version and managed-policy state; it does not involve opening suspect content.
WebAssembly and garbage collection: three OpenAI reports
OpenAI’s Amy Burnett reported CVE-2026-74936, a use-after-free in JavaScript WebAssembly, and CVE-2026-74937, a use-after-free in the JavaScript garbage collector. A third issue, CVE-2026-74938, is a mitigation bypass in the same GC area. The combination matters because WebAssembly and JIT engines process high-complexity code while the collector controls the lifetime of objects across many optimisations.
A use-after-free occurs when software accesses an object after releasing its memory. An attacker attempts to have the region reused with controlled data. Depending on context and control of heap layout, consequences can range from a crash through memory disclosure to code execution. The class alone does not prove a working RCE, but it is serious in a browser.
A mitigation bypass may look less dramatic in a headline yet increase the reliability of a larger chain. Type checks, heap isolation, allocator hardening and process sandboxing assume that breaking one barrier still leaves others. An update that repairs both a primitive and a defensive weakness can therefore matter more than a raw CVE count suggests.
CanvasWebGL, graphics and site boundaries
CVE-2026-74934 is a site-isolation issue in Graphics: CanvasWebGL. CVE-2026-74941 is a privilege escalation in the same component, while CVE-2026-74946 involves incorrect boundary conditions. The bulletin also includes use-after-free defects in text rendering, ImageLib and Canvas2D, plus graphics information-disclosure issues.
A browser passes attacker-controlled data through complex rendering layers and frequently to a GPU driver. Canvas and WebGL are designed for speed while still needing origin isolation. A site-isolation weakness may let one origin affect data or state belonging to another context. A memory defect may provide control of the process. They are different boundaries, but a chain can combine them.
Disabling WebGL across an enterprise may reduce some attack surface, but it creates compatibility problems and does not remove other graphics defects. It can be an emergency measure for tightly controlled environments, not a patch substitute. Rapid deployment, reducing unnecessary extensions and blocking known malicious sources are more sustainable controls.
DOM, networking and the same-origin policy
Firefox 154 repairs privilege escalation in DOM Networking and DOM Navigation and a use-after-free in DOM Core & HTML. Moderate findings include same-origin-policy bypasses involving Service Workers, cookies, media playback and ImageLib. The same-origin policy separates documents by scheme, host and port to restrict one site from reading another context.
Breaking that policy need not execute a native program on the endpoint to cause a serious incident. A page may attempt to access an active corporate application session through cache, a service worker or cookie behaviour. Proxy and EDR telemetry may show no classic child process. The incident instead appears as unauthorised access between browser contexts.
After patching, review applications that depend on legacy exceptions, enterprise browser policies and extensions. Unusual CORS exceptions, disabled isolation or an extension with access to every site may preserve an alternative path even after the engine flaw is repaired.
Grouped CVEs and what ESR really means
CVE-2026-74987, CVE-2026-74988, CVE-2026-74989 and CVE-2026-74990 group internally discovered defects. Mozilla says some showed evidence of memory corruption or other security problems and could presumably have been exploited with enough effort. That language is not evidence of attacks in the wild.
ESR scope differs by branch. Firefox ESR 115.39 and 140.14 have separate advisories, while ESR 153.1 appears in some grouped fixes. Administrators need the advisory for the maintained branch. CVE-2026-75874 must not be mechanically assigned to every ESR release merely because the updates appeared on the same day.
ESR does not mean “no updates for a year.” It provides a more stable feature branch that still receives recurring security releases. A device on ESR 140.13 is not compliant merely because major version 140 remains supported.
Enterprise rollout plan
First inventory Firefox installed system-wide, in user profiles, as portable software, in VDI and within testing images. Separate Release and ESR channels. Confirm the runtime version after a process restart because an update may have downloaded while a user keeps the same session running for days.
Then:
- deploy Firefox 154 or the appropriate supported ESR through endpoint management;
- enforce browser restart within a short, communicated window;
- identify devices unseen by management since the release date;
- remove old parallel installations and unauthorised portable copies;
- verify automatic-update policy and whether users can disable it;
- restrict extensions to an approved list and review host permissions;
- monitor content, GPU and JavaScript process crashes by domain and version;
- retain compliance history proving when exposure actually closed.
If immediate deployment is impossible, short-lived mitigations include restricting untrusted browsing for privileged accounts, using an updated alternative browser and separating administrative workstations. Do not treat a corporate application’s WAF as protection against a malicious site opened in another tab.
Vendor facts and Breachroad analysis
The CVE list, impact ratings, reporters and fixed releases come from Mozilla. Absence of an active-exploitation label means only that the advisory does not make that claim. The chaining analysis, privileged-account priority and telemetry guidance are Breachroad conclusions.
A browser is the shared runtime for email, SaaS, SSO and administrative consoles. Updating it belongs in a formal vulnerability-management process, not a user’s private choice. Cybersecurity training for organisations reduces exposure to malicious links and fake updates, while an IT security audit can verify browser policy, EDR and patch evidence.
