Mozilla Firefox CVE-2026-74978

The attacker must serve a malicious webpage to the target user, and the user must visit that page and perform at least one click interaction - consistent with the CVSS UI:R metric. The vulnerability is present in the Firefox Widget component without requiring any non-default browser configuration; standard Firefox installations running versions prior to 154 (or ESR prior to 153.1) are vulnerable. No authentication to any service is required from the attacker's perspective (CVSS PR:N). Exploitation is bounded by the requirement for user interaction - the victim must click within an attacker-controlled overlay - and impact is scoped to actions the Widget component can perform rather than arbitrary OS-level code execution. The specific Widget dialog type or sub-feature that triggers the vulnerable rendering path is not detailed beyond the bugzilla reference at https://bugzilla.mozilla.org/show_bug.cgi?id=2036097.

The CVSS 8.1 High rating is driven by network delivery (AV:N), low complexity (AC:L), no required privileges (PR:N), and high confidentiality and integrity impact scores - unusual severity for a pure clickjacking flaw, suggesting the Widget component exposure can be leveraged for more than superficial click-hijacking and may enable sensitive browser actions or meaningful data exposure. User interaction is required (UI:R), which limits exploitation relative to fully automated attacks. EPSS data was not supplied in the intelligence feed, constraining probabilistic exploitation forecasting; absence of a KEV listing and confirmed POC places exploitation urgency at elevated-moderate rather than emergency tier. Even a mid-sized municipal IT team in boleslawiec should treat this as an urgent patch cycle item given Firefox's massive deployment footprint and the trivially low barrier for an attacker to serve a malicious page. The tagging discrepancy between the 'XSS' metadata label and the CWE-1021 root-cause classification is a signal-integrity concern: if an XSS component is present alongside the clickjacking, the CVSS C:H and I:H scores may be further justified, but this must be verified against the upstream advisory before communicating scope to stakeholders.

An attacker hosts a malicious webpage containing a transparent iframe or overlay layer positioned precisely over a Firefox Widget element such as a permission dialog button or browser prompt. When a targeted user visits the page and clicks what appears to be a benign UI control, the click is silently captured by the hidden Widget target, potentially confirming a sensitive browser permission, initiating an unintended download, or completing a high-impact browser action. No public exploit code has been identified at time of analysis, but the attack technique is well-understood and requires no specialized tooling to implement.