Mozilla Firefox CVE-2026-109708

Exploitation requires the victim to load attacker-controlled or compromised web content in Firefox that reaches the vulnerable code path in the Networking component (UI:R) - there is no fully passive, no-interaction vector. No authentication is required (PR:N) and default configurations are affected, since this is a memory-safety defect in a core browser component rather than a feature that must be explicitly enabled. Limiting factors: the user-interaction requirement, the fact that a sandbox escape alone generally must be chained with a separate content-process code-execution primitive to achieve full host compromise, and that patched builds (Firefox 158 / ESR 153.5 and later) are not vulnerable.

This is a genuinely high-priority flaw despite several tempering signals. The CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C, C:H/I:H/A:H) reflects a remotely reachable, low-complexity, unauthenticated memory-safety bug that breaks the browser sandbox (scope change) with full confidentiality, integrity, and availability impact. The only built-in brake is UI:R - a victim must be lured to attacker-controlled content. Counterbalancing the high CVSS: EPSS is only 0.19% (8th percentile), there is no CISA KEV listing and no public POC identified, so there is currently no evidence of active or imminent mass exploitation. The low EPSS alongside a high CVSS is typical for a freshly-patched browser sandbox escape - the risk is latent and depends on exploit development rather than demonstrated in-the-wild use. No signals conflict with the CVSS vector itself; the description ('sandbox escape in Networking component', buffer overflow) is fully consistent with AV:N and S:C. Note that a browser sandbox escape alone usually requires chaining with a content-process RCE to be weaponized end-to-end, which raises real-world exploitation complexity beyond what the raw score implies. SSVC framing: exploitation = none observed, automatable = no (requires user interaction/luring), technical impact = total. Verdict: patch promptly given ubiquity and total impact, but there is no evidence this is being exploited today.

An attacker hosts or compromises a web page carrying malicious network-handling content and lures a victim into visiting it (UI:R). The crafted input triggers the buffer overflow in Firefox's Networking component, letting attacker code escape the content sandbox and run with the privileges of the browser process. No public exploit code has been identified at time of analysis, and a practical attack would typically need to be chained with a content-process code-execution bug.