CVE-2026-74986 is a site isolation issue in the CSS Parsing and Computation component of Mozilla Firefox. It was addressed and fixed in Firefox 154 and Firefox ESR 153.1. The vulnerability has a CVSS score of 9.1, indicating critical severity, with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and availability. The vendor advisory confirms the fix in Firefox 154.

This vulnerability allows an attacker to bypass site isolation protections, potentially leading to information disclosure (confidentiality impact) and denial of service (availability impact). The CVSS score of 9.1 reflects a critical impact level. There are no known exploits in the wild at this time.

Users and administrators should update affected Firefox versions to Firefox 154 or later, or Firefox ESR 153.1 or later, where this vulnerability is fixed. No additional mitigation is required once the update is applied.