Mozilla Firefox CVE-2026-74985

The vulnerability resides specifically in Firefox's Enterprise Policies component, so exploitation is most relevant to deployments that actually use enterprise policy management (policies.json / GPO / MDM), and the escalation targets the privilege boundary those policies enforce. The published CVSS metrics (AV:N/AC:L/PR:N/UI:N) indicate no authentication and no user interaction, but this conflicts with the privilege-escalation nature of the bug, which typically presupposes some local presence or ability to influence the policy/browser context - this discrepancy should be confirmed against Mozilla's advisory. Limiting factors: relevance is greatest where Enterprise Policies are configured, and the fix in Firefox 154 / ESR 153.1 fully removes the exposure.

The signals conflict and warrant caution. The published CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a remote, unauthenticated, no-interaction attack, but the vulnerability class - 'Privilege escalation' in the Enterprise Policies component (CWE-269) - strongly implies a local or already-present actor escalating within an administratively managed deployment; verify the attack vector with Mozilla's advisory, as network-unauthenticated exploitation of a policy-enforcement bug is atypical. EPSS is very low (0.15%, 5th percentile), there is no KEV listing and no public exploit identified, so despite the 9.8 headline this does not currently present as a mass-exploited threat. Real-world priority is driven mainly by Firefox's ubiquity and the ease of patching rather than by demonstrated exploitation; treat it as a standard-cadence browser update rather than an emergency, unless the environment relies heavily on Enterprise Policies as a security control.

In an enterprise Firefox deployment governed by Enterprise Policies, an attacker with limited access to the endpoint or browser context abuses the improper privilege handling in the policy component to escalate to privileges the organization's policies were meant to withhold, loosening security restrictions or gaining fuller control of the browser. No public exploit is identified at time of analysis; the published CVSS AC:L suggests that, once the required access is obtained, the technique itself is low-complexity.