On August 18, 2026, Mozilla fixed CVE-2026-75874, a sandbox escape in Firefox’s Remote Settings component rated CVSS 10.0 and exploitable with no interaction at all. Update Firefox and Thunderbird 154 across the fleet without waiting.

An unencrypted copy of the GPG key that signs Firefox and Thunderbird Linux downloads landed in an internal Git repository by mistake. Mozilla immediately revoked the key and began a full rotation — every Linux distribution packaging the browser must rebuild against the new key.