Mozilla Firefox CVE-2026-100831

Exploitation requires the victim to use a vulnerable Mozilla Firefox (before 157) or Firefox ESR (before 153.4) and to load attacker-controlled web content that drives the DOM UI-event and focus-handling code paths into a use-after-free (per CVSS UI:R). No authentication or elevated privileges are needed (PR:N), and the attack works over the network against default browser configurations. The key limiting factor is mandatory user interaction - the target must navigate to or render the malicious page - and successful control-flow hijack additionally depends on browser-specific heap grooming, which is why CISA SSVC rates it Automatable:no. Scope is unchanged (S:U), so impact is confined to the affected content process, not a same-attack sandbox escape.

This is a genuine memory-corruption vulnerability in an ubiquitous browser, but the risk signals are mixed and point to medium rather than emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects an unauthenticated, network-reachable use-after-free with full CIA impact, but the mandatory UI:R (victim must load a crafted page) meaningfully lowers real-world urgency versus a drive-by-with-no-interaction flaw. CISA SSVC reinforces this: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-automated because it needs victim interaction and browser-specific heap grooming), Technical Impact=total. There is no CISA KEV listing, no public POC, and no EPSS score provided. Net: no public exploit identified at time of analysis, so this is a real priority for patch management (browser UAFs are historically weaponizable and part of a large coordinated Mozilla batch) but not an actively-exploited zero-day. One data-quality note: the 'Information Disclosure' tag understates the issue - a UAF (CWE-416) rated C:H/I:H/A:H is memory corruption / RCE-class, not info-only.

An attacker hosts or compromises a web page containing crafted markup/JavaScript that manipulates DOM UI-event and focus handling to free an object still referenced elsewhere, then reclaims the freed memory with attacker-controlled data. When a victim running a vulnerable Firefox/Firefox ESR visits the page, the dangling pointer is dereferenced, corrupting memory to leak data or hijack control flow within the content process. No public POC or active exploitation is known at time of analysis.