CVE-2026-74960 is a security vulnerability affecting the site isolation feature within the WebExtensions component of Mozilla Firefox. Site isolation is a security mechanism designed to separate web content from different origins into different processes to prevent data leaks and privilege escalation. This vulnerability could allow an attacker to bypass these isolation boundaries, potentially exposing sensitive data or enabling unauthorized actions. The flaw was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The CVSS 3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts.

Successful exploitation of this vulnerability could allow an attacker to bypass site isolation protections in the WebExtensions component, potentially leading to unauthorized access to sensitive information or privilege escalation within the browser context. The CVSS score of 8.1 reflects a high impact on confidentiality and integrity. However, there are no known exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official patches.