Site Isolation Flaw in WebRender of Firefox/Thunderbird (v<154): CVE-2026-74968 August 2026

Site Isolation Flaw in WebRender of Firefox/Thunderbird (v<154)
CVE-2026-74968 Published on August 18, 2026

Site isolation issue in the Graphics: WebRender component
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Vulnerability Analysis

CVE-2026-74968 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

Origin Validation Error

The software does not properly verify that the source of data or communication is valid.

Products Associated with CVE-2026-74968

stack.watch emails you whenever new vulnerabilities are published in Mozilla Firefox or Mozilla Thunderbird. Just hit a watch button to start following.

Affected Versions

Version 153.1, <= 153.* is unaffected.

Version 154, <= * is unaffected.