Firefox patches a critical use-after-free bug - but is it really a 9.8?
A newly disclosed WebAssembly flaw in Firefox scores near the top of the danger scale, though Mozilla's own rating and the lack of any known attacks tell a calmer story.
Mozilla has patched a “use-after-free” bug in Firefox’s WebAssembly engine that the US National Vulnerability Database has scored 9.8 out of 10 - about as severe as these ratings get. The fix landed in Firefox 154, along with updated ESR and Thunderbird builds, on 18 August 2026. If you’re running an up-to-date browser, you’re already covered.
What the bug actually does
The flaw, catalogued as CVE-2026-74936, sits in the “JavaScript: WebAssembly” component of Firefox - the part of the engine that runs near-native-speed code inside web pages. A use-after-free happens when a program keeps using a chunk of memory after it’s been freed up for something else, which can let an attacker corrupt memory and potentially run their own code on your machine.
NVD’s automated scoring puts this at CVSS 3.1 “9.8 CRITICAL”, with a vector suggesting it could be triggered remotely, with low complexity, no privileges and no user interaction beyond visiting a malicious page. Mozilla’s own advisory, by contrast, rates the bug’s impact as “high” rather than critical - a reminder that vendor and NVD severity labels don’t always agree, and that NVD’s number is a generic technical score rather than a verdict on real-world danger.
The bug was reported by Amy Burnett of OpenAI, who is also credited with two other use-after-free and mitigation-bypass bugs fixed in the same release round. The underlying bug report on Bugzilla remains access-restricted, which is standard Mozilla practice while it gives users time to update before technical exploitation details go public.
So who is actually at risk
This affects Firefox and Thunderbird users on desktop - specifically anyone not yet updated to Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154, or Thunderbird ESR-equivalent 140.14/153.1. There is no suggestion in Mozilla’s advisory or the NVD entry that this vulnerability has been exploited in the wild; it appears to have been found and reported responsibly before anyone could weaponise it.
It’s also worth being clear about what this isn’t: it’s not a Chrome, Edge or Safari issue, it’s not an Android/iOS-specific flaw, and there’s no indication it’s being used in phishing campaigns or malware right now. It sits alongside a batch of other high-severity fixes in the same advisory, several involving sandbox escapes and privilege escalation, suggesting a routine (if unusually busy) patch cycle rather than an active emergency.
What to do about it
Update. Firefox and Thunderbird update automatically for most people, but it’s worth checking manually: in Firefox, go to the menu, then Help, then “About Firefox” - the browser will check for and install updates on that screen. If you’re on an older ESR build used by an organisation, IT teams should confirm the 140.14 or 153.1 branch has been rolled out.
The takeaway
A critical-sounding score, a genuine memory-safety bug, and a fix that’s already out - this is Mozilla’s patch process working as intended, not a five-alarm emergency. As long as your browser is current, there’s nothing further to do here beyond letting the update finish.