Mozilla Firefox CVE-2026-74963

The victim must be running an unpatched version of Mozilla Firefox - specifically, standard release versions prior to 154, ESR 140.x versions prior to 140.14, or ESR 153.x versions prior to 153.1. The CVSS PR:N confirms no authentication to any service is required by the attacker; however, the CVSS UI:R confirms that the victim must actively navigate to or load an attacker-controlled web resource - passive exploitation without user interaction is not possible. No non-default browser configuration or special extension is required; the flaw exists in the default Networking: Cookies component. Exploitation is limited to the browser's cookie store for the duration of the session (S:U, unchanged scope), meaning the attacker cannot directly pivot to server-side systems or persist beyond cookie theft. The vulnerability affects all platforms where Firefox runs, as the CPE does not constrain by operating system.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N yields a 5.4 Medium score, which is well-calibrated for this class of vulnerability. UI:R is the primary exploitation limiter - an attacker cannot exploit this passively or via automated scanning; the victim must actively navigate to a malicious page. S:U (unchanged scope) and low C/I impact confirm this is a cookie-level issue confined to the browser session, not a server-side or persistent compromise. EPSS data was not provided in source intelligence; KEV status is negative and no POC has been identified, indicating no observed mass exploitation. The risk profile is moderate: organizations running Firefox ESR in enterprise environments should treat this as a standard patch-cycle priority rather than an emergency, while consumer-facing deployments warrant prompt auto-update. The absence of POC combined with the UI:R gate suggests this is not a trivially weaponizable issue, though the low complexity (AC:L) means exploitation is straightforward once a victim is lured to an attacker page.

An attacker registers a domain and hosts a page containing JavaScript that triggers Firefox's flawed cookie origin validation, allowing the script to read session cookies scoped to a separate trusted origin the victim is authenticated to. The attacker delivers the link via phishing email or malvertising, and when the victim clicks it in a vulnerable Firefox version, the attacker's script exfiltrates the victim's session cookie for a banking or enterprise SSO portal, enabling session hijacking without credentials. No public POC has been identified, but the low attack complexity (AC:L) indicates the technique would not require sophisticated exploit development once the bypass mechanism is understood.