Mozilla Firefox CVE-2026-74989

Exploitation requires the victim to run Firefox 153 and to render attacker-controlled web content (visit a malicious page or view attacker-injected content), which is the practical trigger for these Gecko memory-corruption bugs despite the published UI:N metric. Limiting factors: exploitation is client-side and content-driven rather than a remotely reachable service, requires the user to load the malicious content, and Mozilla states meaningful effort would be needed to weaponize the defects - no working exploit is known and the bugs were found internally, not in the wild. Only Firefox 153 is affected; users already on 154+ are not.

Signals conflict and warrant interpretation. The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) implies trivial, zero-interaction remote compromise, but the vulnerability is a client-side browser memory-corruption bug that in practice requires the victim to load attacker-controlled content - so the UI:N metric is almost certainly optimistic and real-world exploitation requires user interaction (verify: description implies content-rendering, not a listening service). Against that high CVSS, EPSS is very low (0.15%, 5th percentile), there is no CISA KEV listing and no public exploit identified, and Mozilla's own wording ('presume that with enough effort some of these could have been exploited') indicates no demonstrated working exploit. Net assessment: patch-worthy because it is a browser RCE class in a widely deployed product, but this is not an actively-exploited emergency - it is a routine memory-safety hardening batch rather than a high-real-risk 0-day, and the 9.8 overstates immediate danger.

An attacker hosts a malicious web page (or injects malicious content into a compromised/ad-served page) crafted to trigger one of the memory-corruption defects in Firefox 153's rendering engine. A victim running the vulnerable version visits the page, the corrupted memory operation is triggered during content parsing, and the attacker attempts to leverage it toward code execution in the browser process. No public proof-of-concept exists, and Mozilla notes exploitation would require significant effort.