Site isolation flaw in Firefox Graphics before v154: CVE-2026-74970 August 2026

Site isolation flaw in Firefox Graphics before v154
CVE-2026-74970 Published on August 18, 2026

Site isolation issue in the Graphics component
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Vulnerability Analysis

CVE-2026-74970 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

Origin Validation Error

The software does not properly verify that the source of data or communication is valid.

Products Associated with CVE-2026-74970

stack.watch emails you whenever new vulnerabilities are published in Mozilla Firefox or Mozilla Thunderbird. Just hit a watch button to start following.

Affected Versions

Version 153.1, <= 153.* is unaffected.

Version 154, <= * is unaffected.