Firefox CVE-2026-100812

Exploitation requires the victim to load attacker-controlled graphics content in Firefox (UI:R - user interaction such as visiting a malicious or compromised web page); it is remote and needs no authentication or privileges (AV:N/PR:N) and is low-complexity (AC:L). The limiting factor is that it cannot be triggered without the user rendering the malicious content, and the impact is confined to availability (browser/tab crash or hang) with no confidentiality or integrity effect and no privilege gain. Applies to Firefox versions prior to 157 and Firefox ESR prior to 153.4; no non-default configuration is indicated.

This is a moderate-severity, availability-only denial-of-service in Firefox's Graphics component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 6.5) describes a remote, low-complexity, unauthenticated attack requiring user interaction (victim must load attacker-controlled content), producing high availability impact but no confidentiality or integrity impact - consistent with the CWE-770 uncontrolled-resource-consumption weakness. All exploitation signals point to low real-world priority: SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial; there is no EPSS score, no CISA KEV listing, and no public POC provided. Exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent - there are no conflicts between the CVSS vector, SSVC, and description. Net: this is a real bug worth patching on normal cadence because of Firefox's ubiquity, but the crash-only impact and lack of any exploitation evidence make it a low-to-medium operational priority rather than an emergency, and it sits well below the C:H/I:H/A:H 8.8 memory-corruption UAF bugs fixed in the same MFSA advisories.

An attacker hosts a web page containing crafted graphics content and lures a Firefox user to visit it (UI:R). Rendering the content triggers uncontrolled resource allocation in the Graphics component, exhausting memory or CPU and crashing or hanging the browser tab/process. No exploit code is publicly available and the outcome is a denial of service only - no code execution or data disclosure.