CVE-2026-74965 is a privilege escalation vulnerability affecting the Shell Integration component in Mozilla Firefox and Thunderbird. The flaw allows an attacker to escalate privileges, potentially leading to full compromise of the affected application. The issue was addressed and fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vendor advisory confirms the fix and no active exploitation has been observed.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the affected Firefox or Thunderbird application, potentially leading to unauthorized access or control over the application environment. The CVSS score of 8.8 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported.

Official fixes are available and have been released in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Users and administrators should update to these versions or later to remediate this vulnerability. No additional mitigation actions are required beyond applying the official updates.