Mozilla Firefox CVE-2026-74972

Exploitation requires the victim to visit a malicious or attacker-influenced webpage using an unpatched Firefox browser, satisfying the user interaction requirement (UI:R). The CVSS vector PR:N confirms no attacker authentication is needed against the browser or any service. The attack is network-delivered (AV:N) against a standard, default Firefox installation - no special configuration or non-default feature enablement is required beyond normal Web Push API availability, which is enabled by default. Exploitation is limited to reading a subset of confidential data (C:L) with no write or denial-of-service capability. Scope is unaffected (S:U), meaning the vulnerability cannot be used to break out of the browser sandbox or compromise the underlying OS from this vector alone. The mandatory user interaction is the primary real-world limiting factor distinguishing this from a fully opportunistic attack.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N yields a 4.3 Medium score, accurately capturing a flaw that is network-reachable and requires no attacker authentication but depends on victim interaction and carries only limited confidentiality impact with no integrity or availability consequences. No EPSS probability data was supplied in the intelligence feed, and the absence of a CISA KEV entry combined with no identified public exploit code suggests this vulnerability has not been widely operationalized. The UI:R constraint is a meaningful real-world limiter - exploitation requires a user to visit or interact with attacker-controlled content, ruling out purely autonomous scanning. Even a mid-sized municipal IT team in olsztyn managing a Firefox-standardized desktop fleet should treat patching as routine cycle work rather than an emergency response, given the limited data exposure and absence of confirmed active exploitation. The primary risk scenario involves targeted credential or subscription-key harvesting against specific users rather than broad opportunistic campaigns.

An attacker crafts a malicious or compromised webpage that triggers interaction with the DOM Push Subscriptions API when visited by a Firefox user, causing the browser to disclose subscription endpoint data or associated keys to the attacker-controlled page context. The victim must visit the page and interact with it (satisfying the UI:R requirement), after which exfiltrated subscription data could be used to impersonate notification sources or de-anonymize the user. No public exploit code has been identified at time of analysis, making opportunistic mass exploitation unlikely in the near term.