CVE-2026-74958 in Firefox
Summary
by MITRE • 08/18/2026
Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The identified vulnerability resides within the Web Real-Time Communication (WebRTC) implementation, a framework designed to enable real-time audio, video, and data communication directly between web browsers without requiring plugins or third-party software. This specific flaw constitutes an information disclosure issue, meaning that under certain conditions, sensitive internal state information or network topology details could be exposed to unauthorized parties interacting with the affected browser instance. Such vulnerabilities in WebRTC are particularly critical because they can undermine user privacy and security by revealing local IP addresses, port numbers, or other metadata associated with peer-to-peer connections. The exposure of this data allows attackers to map the internal network structure of a victim, potentially facilitating further attacks such as direct connection attempts against services running on private interfaces that would otherwise be shielded from external access.
The technical root cause typically involves improper handling of session description protocol (SDP) offers and answers or insufficient validation during the ICE candidate gathering process. In many WebRTC implementations, if the browser fails to correctly filter out local network addresses when communicating with remote peers over public networks, it inadvertently leaks private IP information. This leakage occurs because the signaling server relays these candidates between parties, effectively broadcasting internal network details to anyone who can intercept or access the signaling channel. The flaw represents a failure in enforcing strict privacy boundaries within the media negotiation phase of the WebRTC lifecycle, where local candidate generation should be strictly controlled based on user consent and security policies.
From an operational perspective, this vulnerability poses significant risks related to privacy violation and network reconnaissance. An attacker who can exploit this information disclosure could identify specific devices on a private LAN, determine their operating systems or service configurations through subsequent probing, and potentially bypass firewalls that rely on NAT (Network Address Translation) for protection. This is especially dangerous in enterprise environments where employees use corporate networks connected to the public internet via browsers running vulnerable versions of Firefox. The ability to enumerate internal assets increases the attack surface significantly, allowing adversaries to pivot from a web-based entry point into deeper network layers.
This vulnerability aligns with CWE-200, which categorizes information exposure as an issue where sensitive information is disclosed without proper authorization or control mechanisms in place. It also relates to ATT&CK technique T1078, specifically the aspect of valid accounts being used for initial access if combined with other social engineering tactics, but more directly it supports reconnaissance activities by providing network topology data that aids in lateral movement planning. The disclosure enables attackers to refine their targeting strategies and increases the likelihood of successful exploitation of secondary vulnerabilities within internal services.
To mitigate this risk, organizations must ensure immediate deployment of Firefox version 154 or Firefox ESR 153.1 across all client endpoints. Administrators should verify patch compliance through automated vulnerability management tools that track browser versions in real-time. Additionally, users and developers should review WebRTC configurations to disable unnecessary features such as ICE candidate gathering over public networks if not explicitly required by business logic. Implementing strict Content Security Policy (CSP) headers can also help restrict the execution of scripts that might attempt to exploit this disclosure vector. Regular security audits focusing on media handling components are recommended to detect similar implementation flaws in other web applications relying on real-time communication standards.