Mozilla · Firefox · CVE-2026-74978
**Name of the Vulnerable Software and Affected Versions**
Firefox versions prior to 154
Firefox ESR versions prior to 153.1
Thunderbird versions prior to 154
Thunderbird versions prior to 153.1
**Description**
A clickjacking issue exists in the Widget component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page.
**Recommendations**
Update Firefox to version 154.
Update Firefox ESR to version 153.1.
Update Thunderbird to version 154.
Update Thunderbird to version 153.1.