Mozilla Firefox CVE-2026-74981

The victim must be running Mozilla Firefox below version 154 or Firefox ESR below version 153.1. Exploitation requires active user interaction: the victim must visit an attacker-controlled or compromised webpage (UI:R per CVSS vector) that serves malicious Audio/Video Web Codecs content. No attacker authentication or privileges are required (PR:N per CVSS). The vulnerability is specific to the Web Codecs component processing audio or video media, so a page that does not invoke this API path would not trigger the flaw. Scope is unchanged (S:U), meaning the exploit cannot escape the browser process to compromise the underlying operating system. Limiting factors include the UI:R prerequisite and the absence of known public exploit code, which raises the attacker skill bar for reliable exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) scores 8.1, reflecting low attack complexity, no attacker privileges, and high confidentiality and integrity impact - consistent with a browser-side site isolation bypass exploitable from any network-accessible malicious page. The UI:R requirement means the victim must navigate to a malicious page, which is a realistic but non-trivial precondition and slightly reduces urgency compared to fully passive exploitation. Scope:U (unchanged) indicates the exploit does not escape the browser process itself, limiting blast radius to in-browser cross-origin data access rather than full system compromise. EPSS at 0.15% (5th percentile) suggests very low current exploitation activity, and no CISA KEV listing or public POC has been identified, making this a real but likely not yet weaponized issue. The combination of high CVSS with low EPSS is consistent with a newly disclosed, technically significant browser flaw that has not yet attracted widespread attacker attention - patch promptly rather than urgently deprioritize.

An attacker hosts a webpage containing a crafted audio or video stream processed by the Firefox Web Codecs API. When a user on an unpatched Firefox version visits the page, the malicious codec content exploits the origin validation failure to read session tokens, authentication cookies, or sensitive DOM content from other origins open in the same browser session. Because no POC has been identified at time of analysis, this scenario is inferred from the CVSS vector and site isolation bypass classification rather than confirmed exploitation reports.