CVE-2026-74948Medium· 6.5▾ SunlitInformation disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74945Medium· 6.5Information disclosure in the Graphics: Text component
CVE-2026-74934High· 7.5Site isolation issue in the Graphics: CanvasWebGL component
CVE-2026-74960High· 8.1Site isolation issue in the WebExtensions component
CVE-2026-74959Critical· 9.1Mitigation bypass in the Storage: Cache API component
CVE-2026-74957High· 8.1Mitigation bypass in the Safe Browsing component
CVE-2026-49853High· 7.7tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853)