Mozilla Firefox CVE-2026-109709

Exploitation requires the victim to run an unpatched Firefox (before 158) or Firefox ESR (before 153.5) and to actively load attacker-controlled web content, satisfying the CVSS UI:R requirement - it is not a server-side or self-propagating flaw. The vulnerability lies in the Process Sandboxing component, so a successful attack must break the content-process sandbox boundary; no attacker authentication is needed (PR:N). Limiting factors: mandatory user interaction (opening/rendering malicious content), the need for an unpatched version, and the absence of any observed automation path (SSVC Automatable: no), which together constrain this to targeted, user-driven attacks rather than mass exploitation.

This is a genuinely high-priority client-side vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 and indicates a network-reachable, low-complexity flaw requiring no attacker privileges but DOES require user interaction (UI:R) - consistent with a browser flaw triggered by visiting a malicious page. The affected component is the Process Sandboxing security boundary, so a successful exploit undermines a core defense-in-depth layer, yielding total technical impact (per CISA SSVC: Technical Impact total), which aligns with the combined Information Disclosure and Privilege Escalation outcomes and the high C/I/A ratings. However, the signals are not uniformly alarming: SSVC lists Exploitation as 'none' and Automatable as 'no', meaning no observed exploitation and no reliable mass-automation path (expected, since UI:R forces a human to open attacker content). There is no CISA KEV listing and no public exploit code identified in the provided data, and no EPSS probability was supplied. The CWE-200 (Information Exposure) classification somewhat understates the full impact given the description also cites privilege escalation. Net: a sandbox-escape in a mass-market browser warrants prompt patching, but current evidence points to latent/unexploited risk rather than active, wormable attack.

An attacker lures a user into visiting a malicious or compromised web page in an unpatched Firefox build; crafted content abuses a flaw in the process sandboxing layer to escape the content-process confinement, read sensitive data from other contexts, and escalate privileges on the host. No public proof-of-concept was identified at time of analysis, and the attack requires the victim to actively load the attacker-controlled content (UI:R).