Mozilla Firefox CVE-2026-100808

Exploitation requires the victim to use Mozilla Firefox (versions before ESR 153.4 or before 157) and to visit attacker-controlled web content that registers or abuses a Service Worker to defeat a built-in DOM security mitigation (CVSS UI:R). No authentication is required (PR:N). Limiting factors: user interaction is mandatory (the victim must load the malicious page), it affects only the Firefox/Gecko browser, and as a protection-mechanism bypass (CWE-693) realistic full impact likely depends on chaining with a second vulnerability rather than standalone exploitation.

Signals are consistent and point to a moderate real-world priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R) - consistent with a browser bug triggered when a victim visits a malicious page. However, the exploitation-pressure signals are low: EPSS is only 0.16% (4th percentile), the flaw is NOT listed in CISA KEV, no public POC is identified, and CISA SSVC scores Exploitation=none and Automatable=no. SSVC Technical Impact=total aligns with the C:H/I:H/A:H impact. The tension to note explicitly: high CVSS severity but very low exploitation probability and no evidence of in-the-wild use, so this is a high-impact-but-currently-unexploited issue - patch on a normal cadence, not a drop-everything emergency. One data caveat: this is a mitigation/protection-mechanism bypass (CWE-693), which typically must be chained with another primitive to achieve the full C/I/A impact the vector claims, so the standalone severity may be optimistic.

An attacker lures a Firefox user to a malicious or compromised web page that abuses the Service Workers mitigation bypass to defeat a browser security control. Because UI:R applies, the victim must visit the page, but no authentication is needed (PR:N); the bypass would then be chained with another flaw to reach the high confidentiality, integrity, and availability impact indicated. No public exploit code has been identified at time of analysis.