Mozilla Firefox CVE-2026-109707

Exploitation requires the victim to load attacker-controlled web content in Firefox, triggering the use-after-free in the Networking component - i.e., active browsing to a malicious or compromised page (UI:R), not a background or unattended trigger. No authentication is required (PR:N), and it works against default configurations of affected Firefox builds prior to Firefox 158 and ESR 153.5. The primary limiting factor is the mandatory user interaction (navigation to malicious content), which rules out fully unattended remote exploitation; SSVC additionally rates the attack as not automatable, indicating it is not readily scaled or wormed.

This is a genuinely high-priority memory-safety flaw. The CVSS 9.6 is driven by a network attack vector (AV:N), low complexity (AC:L), no privileges (PR:N), and critically a scope change (S:C) reflecting that the use-after-free allows escape from the Firefox content sandbox into the broader host context with total impact (C:H/I:H/A:H). However, several signals temper the urgency. The CVSS vector requires user interaction (UI:R) - the victim must be lured to attacker-controlled content - so this is not wormable or hands-off. CISA's SSVC framework reinforces this: Exploitation is rated 'none' (no observed exploitation or public PoC) and Automatable is 'no', though Technical Impact is 'total', consistent with a full sandbox escape. No EPSS score was provided in the input, and the vulnerability is NOT in CISA KEV. No public exploit code was referenced. The net picture: a severe, high-ceiling vulnerability in an ubiquitous browser that warrants prompt patching, but current real-world exploitation risk is unconfirmed and gated by user interaction. The SSVC 'Automatable: no' and 'Exploitation: none' ratings suggest this is a patch-on-normal-cycle-to-expedited issue rather than an emergency, unless chained with a drive-by delivery technique.

An attacker crafts a malicious web page that triggers the use-after-free in Firefox's Networking component when a victim browses to it, corrupting memory to escape the content sandbox. Because exploitation requires user interaction (UI:R), delivery typically relies on phishing, malvertising, or a compromised site rather than unprompted remote compromise. No public exploit code was identified in the provided intelligence, and SSVC rates current exploitation as 'none'.