Mozilla Firefox CVE-2026-74944

Exploitation requires the victim to load attacker-controlled web content in an unpatched Firefox (before 154 / ESR 140.14 / ESR 153.1) - i.e., visiting a malicious site or rendering attacker-supplied HTML in an ad, iframe, or embedded view. The affected DOM: Core & HTML code path is reachable in default configurations with JavaScript enabled, so no special browser feature toggle is needed. Limiting factors: although the published CVSS vector states UI:N, in practice a user must navigate to or render the malicious content, and reliably exploiting a use-after-free demands heap grooming and typically an additional sandbox-escape to achieve impact beyond the content process; there is no authentication requirement (unauthenticated, PR:N).

The signals are mixed and worth weighing carefully. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), which treats this as a trivially exploitable remote network flaw - but that vector is questionable for a browser DOM bug: real-world exploitation of a client-side use-after-free requires a victim to load attacker-controlled content, which realistically implies user interaction (UI:R) and non-trivial heap-grooming complexity (AC:H), so the true severity is likely lower than 9.8. Counterbalancing the high CVSS, EPSS is only 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit is identified - so this is not currently an actively-exploited emergency. That said, browser memory-corruption bugs are a favored target for exploit developers and can be chained with a sandbox escape, so patching should not be deferred: any organization running Firefox at scale should roll the update promptly rather than waiting for a proof-of-concept to surface. Verify the vector discrepancy (CVSS UI:N vs. the practical need for a user to visit a page) against the Mozilla advisories before treating the 9.8 as literal.

An attacker hosts a malicious web page (or injects malicious content into a compromised or ad-served frame) containing crafted HTML and JavaScript that manipulates DOM objects to free memory while a dangling reference remains, then reclaims the freed allocation with controlled data. When the victim's unpatched Firefox visits the page, the engine dereferences the stale pointer, giving the attacker memory corruption in the content process that can be developed into code execution. No public exploit is identified at time of analysis, so this scenario is currently theoretical for this specific CVE.