Mozilla Firefox CVE-2026-100760

Exploitation targets Firefox's Security: Process Sandboxing component and requires the victim to load attacker-controlled web content in an affected browser (UI:R), so a user must visit a malicious or compromised page - there is no fully passive or remote-trigger-free path. No special non-default configuration is indicated in the available data; standard Firefox builds prior to ESR 153.4 / Firefox 157 are affected per Mozilla advisories. Limiting factors: the required user interaction, the need for the attacker to supply a working sandbox-escape exploit (none public), and that patched versions (ESR 153.4, Firefox 157) are not vulnerable.

Signals are mixed and point to a genuinely severe but not-yet-weaponized flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated sandbox escape whose scope change and total C/I/A impact reflect code breaking out of Firefox's process sandbox into the host - corroborated by SSVC Technical Impact 'total'. However, the exploitation-side signals are all cold: EPSS is only 0.15% (4th percentile), SSVC Exploitation is 'none', the CVE is NOT in CISA KEV, and no POC is referenced. So this is a high-CVSS issue whose REAL near-term risk is currently moderate rather than emergency: no evidence of in-the-wild use or public exploit, SSVC Automatable 'no' argues against mass/worm-style abuse, and UI:R means a victim must perform an action (typically visiting a malicious page). Note a conflict to resolve: CVSS indicates total confidentiality/integrity/availability via a sandbox escape, yet the input Tag classifies this as 'Information Disclosure' - that tag understates the impact and should be verified against Mozilla's advisory. Also, CWE-693 (Protection Mechanism Failure) matches a sandbox-bypass but is broad; the exact technical root cause is not specified in the provided data. Bottom line: patch promptly as a high-severity browser RCE-adjacent bug, but current telemetry does not indicate active, widespread exploitation.

An attacker hosts or compromises a web page carrying content that exploits a flaw in Firefox's process-sandboxing mechanism; when a victim simply visits the page, code running in the content process escapes the sandbox and gains the privileges of the host browser process. No public exploit code is referenced, so this currently requires attacker-developed exploitation. The attack is network-delivered and low-complexity but depends on user interaction (visiting the malicious site).