CVE-2026-74949 is a use-after-free vulnerability (CWE-416) in the Graphics: Canvas2D component of Mozilla Firefox that enables privilege escalation. The vulnerability was identified internally and reported by researcher r00tdaddy. It affects Firefox versions prior to 154, Firefox ESR versions up to 140.13, and ESR 153.0. The vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Mozilla's official security advisories (MFSA2026-74 and MFSA2026-76) confirm the fixes and provide details on related vulnerabilities addressed simultaneously.

Successful exploitation of this use-after-free vulnerability can lead to privilege escalation within the Firefox process, potentially allowing an attacker to execute code with elevated privileges. The vulnerability impacts confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild at the time of publication.

Mozilla has released official fixes for this vulnerability in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. Users and administrators should update to these versions or later to mitigate the risk. No additional mitigation actions are required beyond applying the official updates.