high8.8
CVE-2026-74952
Privilege escalation in the Application Update component.
Impact
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 154.0.0 |
| Mozilla | Thunderbird | before 154.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=2021757
- https://www.mozilla.org/security/advisories/mfsa2026-74/
- https://www.mozilla.org/security/advisories/mfsa2026-78/
- https://www.mozilla.org/security/advisories/mfsa2026-85/
- https://www.mozilla.org/security/advisories/mfsa2026-88/