Mozilla Firefox CVE-2026-74974

The CVSS vector UI:R confirms that victim user interaction is mandatory - the victim must navigate to or be redirected to an attacker-controlled web page while using an affected Firefox version; passive interception attacks are insufficient. PR:N confirms no attacker-side authentication is required, making this a fully client-side browser exploit. The flaw is specifically triggered through the Graphics: ImageLib component, so image loading must occur as part of the page load or script-driven resource fetch. Limiting factors include: (1) the victim must be running Mozilla Firefox specifically - no other browser is affected by this CVE; (2) only Firefox versions prior to 154 (main) or ESR 115.39 / ESR 140.14 / ESR 153.1 are vulnerable; (3) S:U (unchanged scope) means the attacker cannot directly escape the browser sandbox or pivot to the operating system through this vulnerability alone; (4) C:L/I:L impact bounds the data exposure to partial cross-origin reads or writes rather than full credential or memory disclosure.

The CVSS 5.4 medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) captures a network-accessible, low-complexity vulnerability that requires no attacker authentication but does require user interaction - the victim must visit a malicious page. The unchanged scope (S:U) limits the blast radius to the browser process itself, preventing direct OS-level pivot. No EPSS data was included in the provided intelligence, so probabilistic exploitation likelihood cannot be independently modeled; this is a notable gap given that EPSS would help distinguish opportunistic mass-exploitation risk from targeted use. The CVE is not present in the CISA KEV catalog based on available data, and no public exploit or POC code has been identified, making widespread opportunistic exploitation less likely at this time. Despite the moderate score, even a mid-sized municipal IT team in inowroclaw should treat this as a routine but timely patch priority: Firefox's ubiquitous deployment footprint means the raw exposure surface is enormous, and SOP bypasses - even at C:L/I:L - can enable meaningful theft of session tokens or cross-origin data from authenticated contexts. No conflicts between CVSS metrics and the vulnerability description were identified.

An attacker crafts a malicious web page that serves a specially constructed image resource designed to trigger the origin validation failure in Firefox's ImageLib component. When a victim using an unpatched Firefox version visits or is redirected to the page, ImageLib processes the image and incorrectly bypasses the same-origin policy, permitting the attacker-controlled page to read data from or write to a cross-origin context - for example, reading response content from an authenticated internal application open in another tab. No public proof-of-concept exploit code has been identified, making this scenario more likely for targeted attacks than opportunistic mass exploitation at this time.