Description
Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows an attacker to elevate privileges within the Downloads API component of Firefox and Thunderbird. The flaw was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird ESR 153.1.

Affected Systems

Mozilla Firefox and Thunderbird are affected. Versions prior to 154 and Firefox ESR versions prior to 153.1, and Thunderbird versions prior to 154 and Thunderbird ESR versions prior to 153.1 contain the vulnerability.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% suggests a very low exploitation probability and the vulnerability is not listed in the CISA KEV catalog. However, privilege escalation flaws are generally considered high‑risk because they allow attackers to gain elevated capabilities. The likely attack vector is via malicious web content that interacts with the Downloads API, as the description does not specify an alternative path. Based on the nature of the flaw, the potential for local or browser‑level code execution is plausible.

Generated by OpenCVE AI on August 21, 2026 at 18:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Firefox 154 or newer, or to ESR 153.1 or newer, to receive the official fix.
  • Upgrade Thunderbird to 154 or newer, or to ESR 153.1 or newer, to receive the official fix.
  • If an update is not immediately available, restrict the use of the Downloads API by disabling automatic downloads or enforcing user approval for download actions.
  • Continue monitoring Mozilla security advisories for additional mitigation guidance and apply future patches as they become available.

Generated by OpenCVE AI on August 21, 2026 at 18:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-648
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla thunderbird

Tue, 18 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264

Tue, 18 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
References

Tue, 18 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 18 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-269

Tue, 18 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
Title Privilege escalation in the Downloads API component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-08-21T03:55:27.359Z

Reserved: 2026-08-17T11:57:59.669Z

Link: CVE-2026-74950

cve-icon Vulnrichment

Updated: 2026-08-18T15:53:07.327Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T13:17:31.817

Modified: 2026-08-21T04:18:17.880

Link: CVE-2026-74950

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-18T12:23:36Z

Links: CVE-2026-74950 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T18:15:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-648

    Incorrect Use of Privileged APIs