Mozilla Firefox CVE-2026-100790

Exploitation requires the victim to load attacker-controlled content that is processed by Firefox's XSLT engine - i.e., a page performing an XSL transformation with a malicious stylesheet - so user interaction (visiting/rendering the page) is mandatory (UI:R). No authentication or special privileges are needed (PR:N), and it works against default configurations of affected Firefox and ESR builds since XSLT support is enabled by default. The primary limiting factor is the required user interaction plus the affected version range: only Firefox before 157 and ESR before 153.4 / 140.17 / 115.42 are vulnerable; patched builds are not exploitable. Modern content-process sandboxing may require an additional escape to achieve full system compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a classic browser memory-corruption profile: a remote, unauthenticated attacker reaches the flaw over the network but requires user interaction (the victim must visit or render attacker-controlled content). A CWE-416 use-after-free in the XSLT (XML transformation) component is corruption-class, so despite the 'Information Disclosure' tag the realistic worst case is memory corruption leading to arbitrary code execution in the content process, consistent with C/I/A all High. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - a real but not yet demonstrably weaponized issue. Contrast the signals: the high CVSS is driven by browser ubiquity and RCE-class impact, not by evidence of exploitation; UI:R meaningfully lowers real-world likelihood versus a zero-click bug. This is a genuine patch-priority issue because of Firefox's ubiquity and Mozilla's own advisory, but it is not an emergency in the absence of KEV/POC signals. Note the tag 'Information Disclosure' understates impact - the CWE-416/CVSS I:H+A:H indicates full memory corruption, not an info-leak-only bug.

An attacker hosts a web page containing a malicious XSLT stylesheet/transform that triggers a use-after-free when Firefox processes it. A victim running an unpatched Firefox or ESR build simply visits the page (UI:R), the freed object is reclaimed and reused, and the attacker corrupts memory to achieve code execution in the content process. No public exploit code was identified in the provided data.