Mozilla Firefox CVE-2026-74982

Based on the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U), no authentication or special configuration is required. The attack is network-reachable and requires low complexity. However, the UI:N assertion warrants verification: in practice, browser-based attacks typically require the target user to navigate to attacker-controlled content, which constitutes passive user interaction (UI:R in CVSS 3.1 / UI:P in CVSS 4.0). Exploitation is bounded to the Firefox browser process - no scope change to the host OS is possible (S:U). Impact is exclusively availability (A:H); confidentiality and integrity are unaffected (C:N/I:N), meaning data theft or code execution are not achievable through this vulnerability alone.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a 7.5 score reflecting high availability impact with no authentication barrier, but the EPSS score of 0.15% at the 5th percentile sharply contradicts the urgency implied by the raw CVSS figure - exploitation remains statistically uncommon. There is no CISA KEV listing and no known public exploit code, placing this firmly in the 'patch on schedule' rather than 'emergency response' category for most organizations. The impact is strictly limited to browser-level denial of service; no confidentiality or integrity compromise is possible, and the S:U scope means the underlying OS is not reachable through this flaw. One discrepancy worth noting: the CVSS vector asserts UI:N, but browser-based attacks typically require the user to navigate to a malicious page, which would ordinarily qualify as UI:R - teams should verify with Mozilla whether fully passive network-path exploitation is possible or whether user navigation is the expected trigger. Overall real-world risk is moderate: high-value targets with managed Firefox deployments should patch promptly, while the low EPSS argues against emergency change-freeze exceptions for most environments.

An attacker hosts a malicious web page containing crafted content designed to trigger excessive resource consumption in Firefox's Widget component. A user visits the page - or is redirected to it - and Firefox begins processing the content, exhausting available resources until the browser process crashes or becomes unresponsive. No public proof-of-concept has been identified at time of analysis, and exploitation would likely require some degree of user navigation to the attacker-controlled page.