Mozilla Firefox CVE-2026-74970

Exploitation requires that a victim user actively visits an attacker-controlled web page using an unpatched Firefox browser (all versions before 154 / ESR 153.1). The user must perform some interaction (UI:R per CVSS), which may be as minimal as loading the page depending on implementation details not specified in the advisory. No authentication to Firefox or any service is required from the attacker's side (PR:N). The flaw is limited to Firefox's Graphics component and does not affect other browsers. Exploitation is not automatable per SSVC, meaning mass scanning or worm-style propagation is not feasible. The impact is bounded to partial confidentiality and integrity - availability is not affected (A:N).

The CVSS 3.1 score of 5.4 (Medium) reflects a network-reachable, low-complexity attack that requires no privileges but does require user interaction (UI:R) and results in only partial confidentiality and integrity impact without availability consequence. SSVC corroborates this: exploitation is rated none, the attack is not automatable, and technical impact is partial. EPSS data was not provided, so exploitation probability cannot be quantified independently. There is no KEV listing and no public exploit code. Taken together, this is a real but not urgent vulnerability - the kind where a mid-sized municipal IT department in legnica, running standard enterprise browser policies, would be well-served by folding the Firefox update into its next regular patch cycle rather than treating it as an emergency. The primary risk is targeted cross-origin data disclosure in browser sessions, not mass-exploitation; defenders should weight remediation by how sensitive the data users access through Firefox is.

An attacker hosts a malicious webpage that causes the victim's Firefox browser to render attacker-controlled graphics content alongside a cross-origin target (e.g., an embedded iframe or resource from a banking or intranet domain). When the user visits the attacker page, the Graphics component's site isolation failure allows the attacker's origin to read pixel or DOM data from the target origin, exfiltrating sensitive content displayed in that frame. No public exploit code exists at time of analysis, so exploitation requires custom development.