This vulnerability (CVE-2026-74952) involves privilege escalation in the Application Update component of Mozilla Firefox. It was reported by Tomoya Nakanishi and fixed in Firefox 154. The vulnerability allows an attacker to escalate privileges potentially leading to full compromise of the affected system. The CVSS vector indicates that the attack can be performed remotely over the network with low complexity and no privileges required, but requires user interaction. The impact is high across confidentiality, integrity, and availability. The vendor advisory confirms the fix availability in Firefox 154 and Thunderbird 154.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges on the affected system, potentially leading to unauthorized access and control over the application or system. The high CVSS score reflects significant risk to confidentiality, integrity, and availability if exploited.

Users and administrators should update Mozilla Firefox to version 154 or later to remediate this vulnerability. The vendor advisory confirms that the issue is fixed in Firefox 154. No additional mitigations are specified or required beyond applying the official update.