CVE-2026-74967 is a vulnerability in Mozilla Firefox's Audio/Video: Playback component that allows bypassing the same-origin policy. The same-origin policy is a fundamental security feature that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This bypass could potentially allow unauthorized access to resources or data across origins. Mozilla fixed this vulnerability in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The vulnerability was reported by the Mozilla Fuzzing Team and is classified with moderate impact. There are no known active exploits in the wild for this vulnerability.

The vulnerability enables bypassing the same-origin policy in the Audio/Video: Playback component, which could lead to unauthorized access to web resources or data that should be restricted by origin boundaries. While the impact is rated moderate, it undermines a core browser security control. No active exploitation has been observed, reducing immediate risk, but the potential for abuse exists if left unpatched.

Mozilla has released official fixes for this vulnerability in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches.