False negative CVE: no generated_cpe for `com.mozilla.firefoxdeveloperedition` resulting in missing vulnerabilities

[GrayW]

Fleet versions 4.86.2 // 4.87.1

• Discovered: 4.86.2
• Reproduced: 4.86.2 // 4.87.1

Web browser and operating system: macOS 26

---

💥  Actual behavior

Fleet doesn't appear to be generating a cpe for com.mozilla.firefoxdeveloperedition, which should be tracking with standard, as there is no dedicated CPE for the developer edition. Example: cpe:2.3:a:mozilla:firefox:152.0.3:*.*.*.*:macos:*.*

{
  "software": {
    "id": 3879,
    "name": "Firefox Developer Edition",
    "version": "153.0",
    "bundle_identifier": "org.mozilla.firefoxdeveloperedition",
    "source": "apps",
    "extension_for": "",
    "browser": "",
    "generated_cpe": "",
    "vulnerabilities": null,
    "display_name": "",
    "last_opened_at": ""
  }
}

🛠️ Expected behavior

TODO

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.

1. Deploy or install Mozilla Firefox Developer Edition
2. fleetctl trigger --name=vulnerabilities

🕯️ More info (optional)

• May also affect Beta (Untested)
• Mozilla advisory categories are Firefox or Firefox ESR https://www.mozilla.org/en-US/security/known-vulnerabilities/
• NVD CPE for Firefox 152.0

[raju249]

I raised #48924 for fixing this issue.

@GrayW - Can you help with someone who can review this change and merge?

Thanks!

[GrayW]

Thanks for the contribution @raju249! We'll get that reviewed as soon as we can.