Mozilla Firefox CVE-2026-109706

Exploitation requires the victim to load attacker-controlled web content in an unpatched Firefox (or Firefox ESR) build that exercises the IndexedDB storage API - IndexedDB is enabled by default, so no special browser configuration is needed, but the use-after-free must be triggered through DOM/JavaScript interaction with object stores. The key LIMITING factor is the mandatory user interaction (UI:R): the attacker cannot trigger this against a passive or idle target and must get the victim to visit or interact with a malicious/compromised site. Exploitation is further bounded to versions prior to Firefox 158, ESR 115.43, and ESR 153.5; patched builds are not affected, and SSVC rates the issue non-automatable with only partial technical impact.

This is a moderate-severity memory-safety flaw (CVSS 5.4) whose signals consistently point to LOW real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated, low-complexity issue, but mandatory user interaction (UI:R - a victim must open or interact with malicious web content) and only partial confidentiality/integrity impact (C:L/I:L/A:N) temper the severity. All exploitation signals agree on low risk: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial'; there is no CISA KEV listing and no EPSS score was supplied; and no public exploit was identified in the provided data. Thus there is no 'high-CVSS-but-low-risk' conflict here - the raw score is already moderate and every corroborating source agrees exploitation is neither observed nor automatable. One caveat: use-after-free bugs (CWE-416) in a browser's IndexedDB storage engine often carry latent potential for escalation to code execution beyond the modest C:L/I:L rating, and the three distinct MFSA advisories (mfsa2026-106/107/108) suggest this was bundled in a coordinated release; the assigned impact should be verified against the Mozilla advisory text. EPSS and POC status are MISSING from the input and cannot be asserted either way.

An attacker hosts a malicious web page containing crafted JavaScript that manipulates IndexedDB object stores to trigger the use-after-free, then lures a victim running an unpatched Firefox build into visiting it (satisfying the UI:R requirement). Successful triggering corrupts freed heap memory, potentially leaking small amounts of in-process data or enabling further memory manipulation. No public proof-of-concept was identified in the provided data, and no active exploitation is recorded (SSVC Exploitation: none).