Mozilla Firefox CVE-2026-74957

User interaction is required - the CVSS UI:R metric confirms the victim must actively navigate to or click a link leading to the malicious URL. The vulnerable Safe Browsing component is enabled by default in all Firefox installations, so no non-default configuration is needed on the victim side. Exploitation is limited to scenarios where the target URL would normally be intercepted by Safe Browsing; benign URLs are unaffected. The attacker must control or predict a URL that Safe Browsing would ordinarily flag, meaning the malicious site or URL pattern must already be (or be likely to be) present in Safe Browsing blocklists. Authentication is not relevant to exploitation - the CVSS PR:N vector confirms no privilege level is required on the attacker side.

The CVSS 8.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) reflects meaningful theoretical impact: network-reachable, low complexity, no privileges required, but requiring user interaction. The High ratings for both Confidentiality and Integrity capture the downstream consequence of a successful Safe Browsing bypass - credential phishing and malware delivery are the primary threat scenarios. However, EPSS at 0.16% (6th percentile) strongly undercuts urgency: at time of analysis, this vulnerability has extremely low observed exploitation probability relative to the broader CVE population. There is no CISA KEV listing and no confirmed public exploit code. The gap between CVSS 8.1 and the near-floor EPSS score is notable and suggests this is a high-CVSS-but-low-real-risk issue in practice - the complexity of reliably triggering the bypass in deployed conditions may be higher than AC:L implies, or attacker tooling has not yet emerged. UI:R is a meaningful friction point, as it requires a victim to actively follow a crafted link. This is a patch-priority item for browser hygiene, not an emergency incident-response trigger.

An attacker registers or compromises a domain that Firefox's Safe Browsing service has flagged as a phishing or malware host. By exploiting the bypass, the attacker crafts a URL or navigation sequence that causes Firefox to skip the Safe Browsing interstitial, delivering the user directly to the malicious page. The victim, expecting browser-level protection, proceeds to interact with the phishing page and submits credentials or downloads a malicious payload without any browser warning. No public exploit code has been identified at time of analysis.