CVE-2026-74950 is a privilege escalation vulnerability affecting the Downloads API component in Mozilla Firefox. The flaw allows an attacker to escalate privileges, potentially leading to full compromise of the affected system. Mozilla fixed this vulnerability in Firefox 154 and Firefox ESR 153.1. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild. The vendor advisory confirms the fix and recommends updating to the patched versions.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges, potentially gaining unauthorized access or control over the affected system. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, there are no known active exploits reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 154 and Firefox ESR 153.1. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official update.