Firefox 154 patches a CVSS 10.0 sandbox escape that needs no user interaction
On August 18, 2026, Mozilla fixed CVE-2026-75874, a sandbox escape in Firefox’s Remote Settings component rated CVSS 10.0 and exploitable with no interaction at all. Update Firefox and Thunderbird 154 across the fleet without waiting.
August 18, 2026. CVSS 10.0. No interaction. Mozilla has fixed CVE-2026-75874, a sandbox escape in Firefox’s Remote Settings Client component, rated CVSS 10.0 — the maximum score. The vector is unambiguous: network, low complexity, no privileges, no user interaction, changed scope, and total impact on confidentiality, integrity, and availability. The fix ships in Firefox 154 and Thunderbird 154.
What a 10.0 sandbox escape actually means
A CVSS 10.0 is rare on its own. A 10.0 with no interaction — UI:N in the vector — is rarer still. It means no victim action is required: merely visiting a malicious page, or the component processing some remote content, is enough. There is no attachment to open, no link to click, no dialog to confirm.
The sandbox escape itself is the crossing of a modern browser’s most important security boundary. Firefox isolates web content in a content process with reduced privileges, separated from the parent process that holds user data, files, and network access. A sandbox escape means confined content manages to execute code at the parent-process level — that is, with the user’s rights over the entire machine.
The component at fault: Remote Settings
Remote Settings is the channel through which Mozilla distributes remote configuration data to browsers: Safe Browsing blocklists, system add-ons, Nimbus experiment settings, search configuration. The Remote Settings Client is the browser-side component that downloads, verifies, and applies that data.
It is a prime target for a simple reason: this component by design processes data arriving from a remote server, largely automatically and invisibly to the user. A flaw in its handling opens the door to a compromise that requires no interaction and no sophisticated lure. The associated CWE-693 — Protection Mechanism Failure — describes exactly that: a protection mechanism is in place, but it does not protect.
Why the browser is now the endpoint’s top target
This flaw illustrates a shift that security teams sometimes struggle to accept: the browser is now the most critical attack surface on the endpoint. It is the application that executes the most untrusted code, most often, with the most privileges — and it is the gateway to every web service the business relies on.
A firewall or an EDR can block a malicious executable. It can see very little of a sandbox escape that unfolds inside a legitimate, signed, up-to-date browser. The only reliable defense here is the patch: a fixed sandbox escape stops being exploitable, regardless of the rest of the defense chain.
The fix and the exposure window
Mozilla delivered the fix in Firefox 154 and Thunderbird 154, released on August 18, 2026. The same cycle closed several lower-severity issues — site isolation problems, a Safe Browsing bypass, and WebExtensions issues. Together they make a substantial security batch, but it is CVE-2026-75874 that carries the 10.0.
The real exposure window is hard to bound: Mozilla has not disclosed active exploitation so far, and the flaw is not yet on the CISA KEV list. But for a flaw of this class — no interaction, remote, total impact — the cost of waiting far exceeds the cost of deployment. A patch does not wait for public exploitation to be urgent.
What to do
- Update Firefox and Thunderbird to 154 on every machine, including test environments and personal devices used for work;
- Enforce automatic browser updates, with no way to defer indefinitely;
- Audit deployed versions: a heterogeneous fleet leaves stragglers that stay exposed;
- Shrink the surface: keep extensions to the strict minimum, and route sensitive browsing through an isolated profile or dedicated container.
# Linux — check the installed version
firefox --version
thunderbird --version
# Debian/Ubuntu — update via the package manager
sudo apt update && sudo apt install --only-upgrade firefox-esr thunderbirdThe sandbox escape is fixed browser-side. What is not fixed is how quickly your machines receive the patch — and that is where the residual risk lives.
Verdict
The fix is simple; the stakes are not. Push Firefox 154 and Thunderbird 154 across the fleet immediately, and confirm no machine is stuck on an older version. A CVSS 10.0 sandbox escape with no interaction is the kind of flaw for which there is no credible compensating control: the patch is the defense.
Longer term, treat the browser as what it has become — the most-attacked application in your fleet — with the same rigor of versioning, patch cadence, and monitoring you apply to server infrastructure. The line between endpoint and infrastructure is gone, and the browser sits on it.