Mozilla Firefox CVE-2026-74979

The vulnerability requires the Firefox Add-ons Manager component to be in use (its default, always-present state) on a version prior to Firefox 154 or ESR 153.1. Mozilla's CVSS vector states no authentication and no user interaction (PR:N/UI:N), which would mean exploitation against a default Firefox install without the victim clicking anything - but the mitigation-bypass nature of an add-on-management flaw strongly suggests exploitation is limited by needing an add-on install/interaction or a chain with a second bug, a discrepancy the one-line advisory does not resolve. Key limiting factors: the target must be an unpatched build, and the concrete trigger (which specific add-on mitigation is bypassed and whether a malicious add-on must be presented) is not disclosed in the available data and should be confirmed against Bugzilla bug 2045676.

The signals conflict and should be weighed carefully. Mozilla's CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) implies fully remote, unauthenticated exploitation with no user interaction and full CIA impact - but the described bug is a mitigation bypass in add-on management, a class that in practice usually depends on a user installing or interacting with an add-on, or on chaining with another flaw to be meaningful. The UI:N and PR:N metrics therefore look optimistic relative to the one-line description; verify with Mozilla before treating this as a wormable remote-code path. No EPSS score was supplied, it is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent exploitation. Net: patch it as part of the normal Firefox security-update cadence given the high nominal score and Firefox's ubiquity, but the real-world exploitability is likely lower than the raw 9.8 suggests until Mozilla's advisory detail confirms otherwise.

An attacker leverages the bypass to defeat a Firefox add-on security restriction - for instance getting an extension or add-on operation to proceed that Mozilla's mitigation was meant to block - thereby gaining broader access than intended in the browser context. Given the network attack vector, this could be delivered through a malicious or compromised web page or add-on distribution path; no public POC is currently available, so practical exploitation would require an attacker to independently develop one against the pre-154 code.