Mozilla Firefox CVE-2026-74938

Exploitation targets the Firefox JavaScript engine's garbage collector, so the concrete prerequisite is that the victim renders attacker-controlled JavaScript - i.e. the user opens a malicious or compromised web page in a vulnerable Firefox/Firefox ESR build (any version before 154 / ESR 153.1). Although the supplied CVSS vector states UI:N, the practical limiting factor is user interaction: the target must be induced to load the hostile content, which bounds this from being a fully drive-by, zero-click network attack. A further limiting factor is that CWE-693 denotes a mitigation bypass, so meaningful impact generally requires pairing it with a separate memory-corruption bug; alone it lowers the barrier to exploitation rather than granting direct code execution. No authentication is required against the browser itself.

The provided CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which on paper describes a remote, unauthenticated, no-interaction attack with high confidentiality and integrity impact. This vector warrants scrutiny: browser flaws in web-rendered JavaScript almost always require the victim to load attacker-controlled content, so the UI:N (no user interaction) metric is questionable and likely should be UI:R - teams should treat the effective attack as requiring a user to visit a malicious page. Equally important, CWE-693 signals a mitigation *bypass* rather than a standalone code-execution bug, meaning real-world impact typically depends on chaining this with a separate memory-corruption vulnerability; the high C/I scoring may reflect that chained potential rather than direct exploitability in isolation. Working signals are limited: there is no EPSS score, no KEV listing, and no POC in the supplied data, so no public exploit identified at time of analysis. On balance this is a genuinely high-severity issue in a very widely deployed browser and any operator running Firefox should patch promptly, but the absence of active-exploitation and POC signals suggests it is not (yet) an emergency on the level of a confirmed in-the-wild zero-day; prioritize it as a standard high-priority browser update.

An attacker hosts a malicious web page containing crafted JavaScript that abuses the GC mitigation bypass, then lures a Firefox user to visit it (via phishing link, malvertising, or a compromised site). The bypass neutralizes a memory-safety hardening measure, and when combined with a memory-corruption primitive it can lead to disclosure of sensitive process memory or code execution in the browser content process. No POC is present in the provided data, so this scenario is inferred from the component and CVSS impact metrics.