CVE-2026-74939 is a privilege escalation vulnerability in the DOM Navigation component of Mozilla Firefox. It was addressed in Firefox 154 and Firefox ESR 115.39, 140.14, and 153.1 releases. The vulnerability allows escalation of privileges from an unprivileged context, impacting the browser's security. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Mozilla's security advisories confirm the fix and provide detailed references to the underlying bugs.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox browser environment, potentially leading to full compromise of the affected application. The high CVSS score indicates severe impact on confidentiality, integrity, and availability of the browser process. However, no active exploitation in the wild has been reported to date.

This vulnerability is fixed in Firefox 154, Firefox ESR 115.39, 140.14, and 153.1, as well as corresponding Thunderbird versions. Users and administrators should update to these fixed versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official updates provided by Mozilla.