Mozilla Firefox CVE-2026-74958

The target must be running Mozilla Firefox prior to version 154 (standard channel) or Firefox ESR prior to version 153.1, and must visit or be redirected to a malicious or compromised web page under attacker control. WebRTC must be enabled in the browser, which is the default configuration in all standard Firefox installations - no non-default setting is required to be vulnerable. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, elevated complexity, or explicit additional user interaction is asserted beyond the page load itself, though this conflicts with the CWE-1021 root cause class which typically implies at least passive UI exposure. Exploitation is bounded to confidentiality impact only; integrity and availability are not affected. Users on Firefox 154+ or ESR 153.1+ are fully remediated and not exploitable through this vector.

The vendor-supplied CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5, indicating a high-severity, fully network-accessible, unauthenticated disclosure with no complexity barrier. SSVC assessment corroborates automatable exploitation potential, meaning an adversary can script attacks at scale against any visiting Firefox user without manual targeting. However, SSVC technical impact is rated only 'partial,' and active exploitation has not been confirmed - KEV status is absent from the source data and no public exploit code has been identified. The EPSS score was not provided in source intelligence, leaving probabilistic exploitation likelihood unquantified. A notable tension exists between the CWE-1021 root cause - which typically involves a user perceiving and interacting with a deceptive UI layer - and the vendor's UI:N metric, suggesting either that the WebRTC trigger requires no secondary user action beyond page load, or that the metric assignment warrants independent verification against the Mozilla advisories. Even a mid-sized municipal IT team in sopot managing a standard Windows desktop fleet should treat this as high priority given Firefox's ubiquitous deployment and the zero-prerequisite attack profile indicated by the CVSS vector. The absence of KEV listing and public exploits moderates immediate urgency relative to the raw score.

An attacker hosts a malicious webpage containing crafted WebRTC session setup code combined with improperly restricted UI layer elements that exploit the CWE-1021 flaw to read sensitive data across frame boundaries or from the WebRTC context. A Firefox user who visits the page - through a phishing link, malvertising redirect, or compromised third-party site - triggers the WebRTC component, which leaks confidential data (such as local IP addresses, media device identifiers, or session tokens) to the attacker-controlled origin. No public proof-of-concept has been identified at time of analysis, but SSVC confirms the attack is automatable, meaning passive mass harvesting from all visiting Firefox users is theoretically feasible at scale.