Mozilla Firefox CVE-2026-100809

Requires an unpatched Firefox before version 157 or ESR before 153.4. Exploitation is remote and needs no attacker-side authentication, but is gated by user interaction (UI:R): the victim must load attacker-controlled content and engage the vulnerable DevTools same-origin-policy code path. Impact is cross-origin data access and manipulation (C:H/I:H) against origins the victim is already logged into; there is no availability impact and no scope change to other components. The DevTools dependency narrows realistic targeting versus plain drive-by browsing.

Signals point to a real but non-urgent, medium-priority browser flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High) describes a network-reachable, unauthenticated same-origin-policy bypass requiring user interaction, with high confidentiality and integrity impact but no availability impact. Counterbalancing this, EPSS is only 0.16% (4th percentile), the CVE is not in CISA KEV, and no public exploit is identified - so despite the High base score, real-world exploitation pressure is currently low. The UI:R requirement (victim must load attacker content and/or trigger the DevTools code path) is the main brake on the otherwise unauthenticated vector. Note a signal gap: the base score reports PR:N/UI:R, but exploitation realistically depends on the victim engaging DevTools or a DevTools-driven flow, which is a less common user action than normal browsing - this narrows the practical attack surface below what AV:N/AC:L alone implies. The 8.1 is vendor-self-reported (Mozilla); treat it as credible but not independently re-derived.

An attacker hosts a malicious page and lures a Firefox user (pre-157 / pre-ESR 153.4) to open it; through the DevTools same-origin-policy weakness, script running in the attacker's origin reads and manipulates data belonging to another origin the victim is authenticated to (e.g. webmail or a web app), enabling cross-origin data theft and tampering. No authentication is needed on the attacker side, but victim interaction is required. No public proof-of-concept is identified at time of analysis.