EUVD-2026-60680
GHSA-85g2-phqx-wgj2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
S:C assigned independently because the Application Update component on Windows invokes a SYSTEM-privileged service, constituting a scope change beyond the browser process.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154.
Articles & Coverage 1
AnalysisAI
Privilege escalation via the Application Update component in Mozilla Firefox allows a network-adjacent attacker, with user interaction, to gain elevated privileges with high impact to confidentiality, integrity, and availability. All Firefox versions prior to 154 are affected per Mozilla CPE data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required (UI:R per CVSS vector) - passive drive-by exploitation without any user action is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score reflects a high-severity, network-accessible attack with no privilege prerequisite (PR:N) and only user interaction required (UI:R), with high impact across all three CIA pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts or compromises a web resource that triggers Firefox's Application Update component to process a maliciously crafted update payload or invokes the update flow in a way that exploits the improper privilege management. The user visits the page or interacts with a browser prompt, satisfying the UI:R requirement, after which the update component executes attacker-influenced code at an elevated privilege level, yielding full confidentiality, integrity, and availability impact. … |
| Remediation | Upgrade Mozilla Firefox to version 154 or later, which contains the vendor-released fix as confirmed by Mozilla Security Advisory mfsa2026-74 (https://www.mozilla.org/security/advisories/mfsa2026-74/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately disable automatic Firefox updates across all managed systems to prevent exploitation through the update mechanism, and communicate the vulnerability and advisory to all users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today