EUVD-2026-60678
GHSA-hhfp-m479-hqjj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable browser flaw requiring only user download interaction; no attacker credentials needed; high CIA impact within the browser privilege boundary.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires active user interaction with a download trigger - specifically, the user must click a download link or interact with a browser-prompted download on an attacker-controlled or compromised site, as indicated by UI:R in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8, reflecting network-reachable exploitation requiring only a single user interaction, with no privileges needed from the attacker and high impact across all three CIA pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts or compromises a website to serve content that triggers a crafted interaction with Firefox's Downloads API - for example, a specially constructed download prompt or download link that exploits the improper privilege check. When a user running a vulnerable Firefox version visits the page and interacts with the download trigger (such as clicking a link or confirming a browser download dialog), the privilege escalation fires within the browser process, granting the attacker elevated capabilities over the user's browser context and potentially their local data. … |
| Remediation | Upgrade Mozilla Firefox to version 154 or later for the standard release channel, and to version 153.1 or later for the ESR channel - these are the vendor-confirmed fixed versions per Mozilla's security advisories at https://www.mozilla.org/security/advisories/mfsa2026-74/ and https://www.mozilla.org/security/advisories/mfsa2026-77/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Firefox installations and versions across your environment, issue a security alert instructing users to exercise extreme caution with downloads from untrusted sources, and implement technical controls where possible such as sandboxing Firefox or restricting the Downloads API through Group Policy or Mobile Device Management. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today