CVE-2026-74953 is a privilege escalation vulnerability affecting the Networking: Cookies component in Mozilla Firefox and Thunderbird. The flaw allows an attacker to escalate privileges, potentially compromising the security context of the affected application. Mozilla fixed this vulnerability in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The CVSS v3.1 base score is 8.8, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory explicitly states the fix availability and does not report active exploitation in the wild.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox or Thunderbird application, potentially leading to unauthorized access to sensitive information, modification of data, or disruption of service. The high CVSS score reflects the severity of impact on confidentiality, integrity, and availability. However, there are no known active exploits in the wild at this time.

Users and administrators should apply the official patches provided by Mozilla by upgrading to Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, or Thunderbird 153.1. The vendor advisory confirms that these versions contain the fix for this vulnerability. No additional mitigation steps are required beyond applying the official updates.