CVE-2026-74960 is a site isolation issue affecting the WebExtensions component in Mozilla Firefox. Site isolation is a security feature designed to separate web content from different origins into distinct processes to prevent cross-site data leaks or attacks. The vulnerability was reported by Khanh Nguyen and is classified with moderate impact. It was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 as part of a comprehensive security update addressing multiple vulnerabilities. The Mozilla advisories confirm the availability of official fixes for this and related vulnerabilities.

The vulnerability could potentially allow an attacker to bypass site isolation protections within the WebExtensions component, which may lead to unauthorized access to data or privilege escalation within the browser context. However, the vendor classifies the impact as moderate for this specific issue. No known exploits in the wild have been reported. The fix mitigates the risk by correcting the site isolation implementation.

Users and administrators should update Mozilla Firefox to version 154 or later, or Firefox ESR to version 140.14 or 153.1 or later, where this vulnerability is fixed. Applying these official updates fully mitigates the vulnerability. No additional mitigation steps are required beyond installing the vendor-provided patches.