Firefox CVE-2026-74966

Any Firefox installation prior to version 154 (or ESR prior to 153.1) is in scope when the user has stored data in Firefox's Form Autofill system, which is enabled by default in standard consumer installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N) as submitted by Mozilla indicates no special server-side configuration, authentication, or explicit user interaction is required. Exploitation is naturally bounded by autofill content: users who have never saved autofill profiles have no sensitive data exposed through this path. Firefox deployments with Form Autofill explicitly disabled via enterprise policy (AutofillAddressEnabled=false, AutofillCreditCardEnabled=false) are not vulnerable.

The CVSS 7.5 High rating is driven by a network-accessible, unauthenticated, low-complexity vector with no user interaction required and high confidentiality impact, representing a worst-case autofill disclosure scenario. Against this, the EPSS score of 0.14% at the 4th percentile signals very low near-term exploitation probability relative to other tracked CVEs, and the absence of a CISA KEV entry means active exploitation has not been confirmed by any authoritative body. The disconnect between the high CVSS and low EPSS suggests this is a credible but presently untargeted vulnerability - typical of browser disclosure issues that require non-trivial reverse engineering to weaponize reliably. The value of Form Autofill data (personal identifiers, addresses, potentially payment card details) makes this attractive to data-harvesting actors if a reliable exploit were developed, so organizations managing large Firefox deployments should prioritize this fix within their standard patch cycle rather than treating it as an emergency. No conflicting signals are present in the available data; the CVSS UI:N claim is noted as potentially optimistic for a browser-context disclosure but is taken from the vendor-submitted vector.

A threat actor hosts a malicious or compromised web page designed to trigger the Form Autofill disclosure bug when loaded by a Firefox user with saved autofill data. The attacker's page-level script accesses or exfiltrates personal profile data - names, addresses, or payment details - stored in the browser's autofill store, without requiring the user to take any explicit action beyond visiting the page. No public exploit code has been identified at time of analysis.