Mozilla Firefox CVE-2026-100795

Requires the victim to load attacker-controlled web content in a vulnerable Firefox (before version 157) - this is the UI:R user-interaction requirement and the main limiting factor. No authentication or special privileges are needed (PR:N), and it works against default configurations since the Networking component is always active, but exploitation is bounded to the availability impact (browser crash/hang); it does not permit code execution or data access. Fully mitigated by updating to Firefox 157.

This is a genuine but comparatively low-priority issue relative to its Firefox 157 batch-mates. The CVSS 6.5 (Medium) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (UI:R - victim must visit/render attacker content) and yields availability-only impact (A:H, with C:N/I:N). This aligns cleanly with CWE-770 (uncontrolled resource allocation) causing a denial of service, and is a materially lower risk than the sibling MFSA2026-97 CVEs that are memory-corruption/UAF RCE-class (8.8) or sandbox-escape (9.6). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: real and worth patching via the routine Firefox 157 update, but not an emergency - the worst realistic outcome is a crashed/hung browser tab or process, not code execution or data loss. No conflicting signals in the data; the CVSS vector and CWE-770 DoS description are consistent.

An attacker hosts a malicious web page (or malvertisement/compromised site) that abuses the Networking component to trigger uncontrolled resource allocation. When a victim running a pre-157 Firefox loads the page, the browser exhausts memory or another resource and becomes unresponsive or crashes. No public proof-of-concept is available, and the attack yields denial of service only - no code execution or information disclosure.