What is the CVSS score of EUVD-2026-60749?

EUVD-2026-60749 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Mozilla Firefox are affected by EUVD-2026-60749?

A privilege escalation vulnerability in Mozilla Firefox (CVSS 8.8) affects all supported browser versions and permits complete browser compromise when users encounter malicious content, creating…

How to fix or mitigate EUVD-2026-60749?

Within 24 hours, assess Firefox deployment scope and current version distribution across the organization. Within 7 days, implement interim protections including disabling Remote Settings auto-updates via group policy, restrict Firefox usage to trusted internal sites where operationally feasible, apply browser sandboxing configurations, and issue user awareness guidance on untrusted content. Within 30 days, establish a patch readiness plan to deploy vendor fixes within 24 hours of release and maintain daily monitoring of Mozilla advisories and CISA KEV for exploit disclosure or patch availability.

Mozilla Firefox EUVD-2026-60749

| CVE-2026-74942 HIGH

Improper Privilege Management (CWE-269)

2026-08-18 mozilla

GHSA-f6x3-5q9f-gph4

Privilege Escalation Mozilla

8.8

CVSS 3.1 · Vendor: mozilla

Severity by source

Vendor (mozilla) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network vector with no attacker authentication required; user interaction is the sole prerequisite; privilege escalation yields total CIA impact within the unchanged browser scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 16:56 vuln.today

CVE Published

Aug 18, 2026 - 12:23 cve.org

HIGH 8.8

CVE Published

Aug 18, 2026 - 12:23 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.

Articles & Coverage 1

News 12 New Mozilla Vulnerabilities - 12 High Severity, No POC Available Aug 18, 2026

AnalysisAI

Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker prepares malicious web content targeting Remote Settings Client

Delivery

User on unpatched Firefox visits or is redirected to content

Exploit

Remote Settings Client processes attacker-influenced data

Execution

Improper privilege boundary violated in client component

Persist

Attacker achieves high-integrity browser-level access

Impact

Confidential data exfiltrated or browser/profile state manipulated

Access

Attacker prepares malicious web content targeting Remote Settings Client

Delivery

User on unpatched Firefox visits or is redirected to content

Exploit

Remote Settings Client processes attacker-influenced data

Execution

Improper privilege boundary violated in client component

Persist

Attacker achieves high-integrity browser-level access

Impact

Confidential data exfiltrated or browser/profile state manipulated

Vulnerability AssessmentAI

Exploitation	User interaction is required (CVSS UI:R) - the victim must be running an affected Firefox version and must take an action, such as visiting attacker-controlled web content, sufficient to trigger the Remote Settings Client code path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 score reflects a high-severity threat profile: network-accessible (AV:N), low complexity (AC:L), no attacker authentication required (PR:N), but dependent on user interaction (UI:R), with total confidentiality, integrity, and availability impact against the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts or controls web content engineered to interact with Firefox's Remote Settings Client in a manner that triggers the improper privilege management flaw; when a victim running an unpatched Firefox version visits or is redirected to this content, the client processes the attacker-influenced data with elevated trust, allowing the attacker to gain high-impact access to confidential browser data, manipulate browser or profile state, or potentially escalate further to underlying system resources depending on the browser's sandbox configuration. No public proof-of-concept code has been identified at time of analysis.
Remediation	Upgrade to Firefox 154 (mainline) or the applicable ESR fixed version: Firefox ESR 115.39, Firefox ESR 140.14, or Firefox ESR 153.1, as confirmed by Mozilla's MFSA advisories mfsa2026-74 through mfsa2026-77 at https://www.mozilla.org/security/advisories/. … Detailed patch versions, workarounds, and compensating controls in full report.