Mozilla Firefox CVE-2026-74971

Exploitation requires a victim running an unpatched Firefox version (prior to 154, ESR 140.14, or ESR 153.1) to visit or be redirected to an attacker-controlled web page, satisfying the UI:R prerequisite in the CVSS vector. The vulnerability is specific to the DOM UI Events and Focus Handling component, meaning exploitation likely requires triggering particular focus-related DOM event sequences through scripted interaction on the attacker's page. No authentication is required of the attacker (PR:N per CVSS vector), and no non-default browser configuration is indicated as a prerequisite. Exploitation is bounded by: (1) mandatory user interaction - the victim must load attacker content, ruling out purely passive network exploitation; (2) impact limited to partial confidentiality disclosure with no integrity or availability consequence; and (3) the exact data accessible is not specified in public CVE data - the precise leakage scope requires review of Bugzilla issue #2057204, which may be restricted.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N yields a Medium score of 4.3. The network attack vector with no privilege requirement is meaningful given Firefox's ubiquitous deployment footprint, but the required user interaction (UI:R) - a victim must visit or be redirected to attacker-controlled content - is a genuine friction point for mass exploitation. Impact is strictly limited to partial confidentiality (C:L) with no integrity or availability consequence (I:N/A:N), making this unsuitable as a standalone compromise vector. No EPSS score was included in the provided intelligence data, so exploitation probability cannot be quantified. KEV status is not confirmed and no public proof-of-concept exists at time of analysis, placing this firmly in the 'patch on your standard cycle' category rather than an emergency response priority. The breadth of simultaneous advisories (mfsa2026-74 through -80) suggests coordinated ESR and release-channel patching rather than an urgency-driven hotfix.

An attacker crafts a web page that manipulates DOM focus events in a specific sequence targeting the vulnerable UI Events handler in Firefox. When a victim navigates to or is social-engineered into visiting this page, the malicious script triggers the information disclosure, potentially reading limited sensitive data - such as cross-origin state indicators or user interaction metadata - that Firefox improperly exposes during focus transitions. No public proof-of-concept exploit has been identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE-200 classification.