CVE-2026-74963 is a vulnerability in Mozilla Firefox's Networking: Cookies component that enables a same-origin policy bypass. The same-origin policy is fundamental to web security, restricting how documents or scripts loaded from one origin can interact with resources from another origin. This flaw could allow an attacker to circumvent these restrictions, potentially leading to unauthorized access to cookie data or other cross-origin interactions. Mozilla fixed this vulnerability in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 as part of a security update announced on August 18, 2026.

The vulnerability impacts the enforcement of the same-origin policy in Firefox, potentially allowing unauthorized cross-origin access to cookies. This could lead to privacy violations or session hijacking if exploited. However, the vendor rates the impact as moderate, indicating that while the flaw is significant, it may require specific conditions or additional factors to be exploited effectively.

Users and administrators should update Mozilla Firefox to version 154, Firefox ESR 140.14, or Firefox ESR 153.1 or later. These versions include the official fix for this vulnerability. No additional mitigation steps are required beyond applying the vendor-provided update.