Skip to content
Hermes Codex

CVE-2026-75874: Mozilla Firefox Critical Sandbox Escape via Remote Settings Client

HERMES

HERMES THREAT SCORE & MAXIMUM SEVERITY BROWSER ESCAPE

Target: Mozilla Firefox / Thunderbird Remote Settings Client Component
Confidence: 99%
100 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 20 / 20
Prevalence 20 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Hermes rates CVE-2026-75874 at the maximum threat score (HTS 100 / CRITICAL). A CVSS 10.0 sandbox escape in the world's primary independent web browser allows an unauthenticated web attacker to execute arbitrary system code with the full privileges of the host user.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-75874: Mozilla Firefox Critical Sandbox Escape via Remote Settings ClientVULNERABILITY

Connected Nodes: 0

1. Metadata & Attack Surface

Section titled “1. Metadata & Attack Surface”
MetricTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-75874Standardized vulnerability identifier
Vendor / SoftwareMozilla / Firefox & ThunderbirdCross-platform web browser & mail client
Affected ReleasesFirefox < 154, Firefox ESR < 140.14Global browser deployments
Fixed ReleasesFirefox 154, Firefox ESR 140.14, TB 154Immediate mandatory update
Associated CWECWE-693: Protection Mechanism FailureComplete sandbox perimeter breakdown
Resulting AccessHost OS Execution (Logged-in User context)Ransomware, spyware, data exfiltration

2. Technical Root Cause Analysis

Section titled “2. Technical Root Cause Analysis”

The vulnerability originates from unsafe deserialization of Remote Settings updates transmitted across the internal content-to-parent process IPC channel:

CVE-2026-75874 Sandbox Escape Flow:


  ┌────────────────────────────────────────────────────────┐
  │ Untrusted Web Page in Sandboxed Content Process        │
  └───────────────────────────┬────────────────────────────┘
                              │
                              │ Forged RemoteSettings IPC Message with
                              │ serialized payload containing malicious object hooks
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Parent Browser Process (Unsandboxed Host Process)      │
  │ - Deserializes update payload without schema checks    │
  │ - Triggers arbitrary object instantiation              │
  └───────────────────────────┬────────────────────────────┘
                              │
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Host Operating System Takeover                         │
  │ - Native binary execution with local user rights       │
  │ - Arbitrary filesystem and network access              │
  └────────────────────────────────────────────────────────┘

3. Remediation & Hardening Playbook

Section titled “3. Remediation & Hardening Playbook”
  1. Apply Browser Updates Immediately:
    Update Firefox to 154 or Firefox ESR 140.14.
  2. Enterprise Policy Enforcement:
    Deploy Firefox Enterprise policies disabling unauthorized background extensions and forcing automatic updates: 
    {
      "policies": {
        "DisableAppUpdate": false,
        "AppAutoUpdate": true
      }
    }