Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-74990 · Microsoft / collected KEV context

cve-program · CVE-2026-74990

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045762%2C2052401%2C2058208
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045774%2C2048490%2C2050864%2C2053159%2C2053260%2C2053261%2C2053582%2C2053599%2C2053607%2C2053608%2C2053853%2C2054626%2C2054627%2C2054635%2C2054677%2C2054740%2C2054832%2C2056792%2C2057098%2C2057100%2C2057101%2C2057103%2C2057117%2C2057118%2C2058048%2C2058049%2C2058622%2C2058623%2C2058665%2C2058666%2C2059121%2C2059164%2C2059188
• https://www.mozilla.org/security/advisories/mfsa2026-74/
• https://www.mozilla.org/security/advisories/mfsa2026-75/
• https://www.mozilla.org/security/advisories/mfsa2026-76/
• https://www.mozilla.org/security/advisories/mfsa2026-77/
• https://www.mozilla.org/security/advisories/mfsa2026-78/
• https://www.mozilla.org/security/advisories/mfsa2026-79/
• https://www.mozilla.org/security/advisories/mfsa2026-80/

• Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 · Advisory content revised · 28 Oct 2026