CVE-2026-74962 is a site isolation issue affecting the Networking: Cookies component in Mozilla Firefox. Site isolation is a security feature designed to separate web content from different origins into different processes to prevent data leakage or unauthorized access. This vulnerability could undermine that isolation, potentially allowing cross-site data access via cookies. The issue was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The CVSS v3.1 score is 8.1 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, scope unchanged, and high impact on confidentiality and integrity. The vendor advisory confirms the fix and recommends updating to these versions.

The vulnerability could allow an attacker to bypass site isolation protections related to cookies, potentially leading to unauthorized access to sensitive cookie data across site boundaries. This could compromise user privacy and security by exposing authentication tokens or session information. The impact is rated high due to the potential confidentiality and integrity violations. However, there are no known exploits in the wild at this time.

A fix is available and users should update to Firefox 154, Firefox ESR 140.14, or Firefox ESR 153.1 to remediate this vulnerability. The vendor advisory confirms the official fix. No additional mitigation actions are required beyond applying the update.