CVE-2026-74971 is a security vulnerability involving information disclosure in the DOM UI Events & Focus Handling component of Mozilla Firefox. The flaw was identified and fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The vendor advisory indicates this is one of many high and moderate impact vulnerabilities resolved in these releases. The advisory confirms the presence of memory corruption or other security-relevant defects in the affected versions, which have been mitigated by the official fixes.

The vulnerability allows information disclosure through the DOM UI Events & Focus Handling component, which could expose sensitive data to unauthorized parties. The vendor rates the impact as moderate for this specific issue. Exploitation could lead to leakage of information that may aid further attacks or compromise user privacy. However, no known exploits in the wild have been reported.

Mozilla has released official fixes for this vulnerability in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. Users and administrators should upgrade to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.