Mozilla Firefox CVE-2026-74937

Exploitation requires passive user interaction (UI:R): a victim must open a malicious or attacker-influenced webpage in an unpatched version of Firefox (prior to 154 / ESR 153.1). No authentication, no elevated privileges, and no non-default browser configuration are required - the JavaScript GC is universally active in all standard Firefox deployments. The key limiting factor is user interaction: the attack cannot be initiated without the victim's browser loading attacker-controlled JavaScript. Scope is unchanged (S:U), meaning successful exploitation is contained within the Firefox browser process and does not inherently yield OS-level code execution without a secondary sandbox escape. Deployment on platforms where Firefox runs in a stricter sandbox (e.g., Firefox for Android under Chrome's process model) may further limit post-exploitation impact.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a score of 8.8 and accurately characterizes a browser-based UAF: network-reachable, low exploitation complexity, no privileges required, but dependent on a user visiting an attacker-controlled page (UI:R). The scope is unchanged (S:U), meaning exploitation is constrained to the browser process rather than escaping to the OS - this limits blast radius compared to a full sandbox escape. No EPSS data was provided in the input, so likelihood of opportunistic exploitation cannot be quantified with that signal. The absence of a CISA KEV listing and no confirmed public POC lowers immediate urgency compared to a KEV entry, but browser UAF vulnerabilities in major engines are historically weaponized quickly by sophisticated actors once a patch is released, as patch diffing can reveal exploitation primitives. The four distinct Mozilla advisories covering the same CVE imply broad surface exposure across release channels.

An attacker registers a domain and hosts a webpage containing crafted JavaScript that manipulates the Firefox heap before triggering a GC cycle, causing the GC to free a live object and leaving a dangling pointer. When an unpatched Firefox user visits the page - via a phishing link, malvertising, or a compromised site - the dereferenced freed memory region is used to overwrite function pointers or control-flow data, achieving code execution within the Firefox renderer process. No public POC has been confirmed at time of analysis, but patch diffing of the Bugzilla issue and the released updates may enable rapid exploit development by capable threat actors.