The version of Firefox installed on the remote Windows host is prior to 154.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-74 advisory.

  - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR     140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. (CVE-2026-74944)

  - Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and     Thunderbird 154. (CVE-2026-75874)

  - Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154,     Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and     Thunderbird 153.1. (CVE-2026-74934)

  - Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154,     Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and     Thunderbird 153.1. (CVE-2026-74935)

  - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154,     Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
    (CVE-2026-74936)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Mozilla Firefox < 154.0

critical Nessus Plugin ID 337629

Version 1.6

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Aug 29, 2026, 12:30 AM Plugin metadata (Add IAVM Info) Plugin Feed: 202608290030
Version 1.5 Aug 24, 2026, 3:52 PM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "CVE-2026-75874" to none) Plugin metadata Plugin Feed: 202608241552
Version 1.3 Aug 21, 2026, 7:41 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2026-74990" to "CVE-2026-74944") Plugin Feed: 202608210741
Version 1.2 Aug 19, 2026, 11:27 AM CVSS metrics ("CVSSv3 score" set to 10.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H") CVSSv3 score source (set to "CVE-2026-75874") Plugin Feed: 202608191127
Version 1.1 Aug 19, 2026, 6:09 AM New Plugin Feed: 202608190609