Mozilla Firefox CVE-2026-109722

Exploitation requires the victim to visit or load attacker-controlled web content (UI:R) in an unpatched Firefox or Firefox ESR build; the vulnerable JIT path in the JavaScript engine is active in default configurations, so no special setting must be enabled by the victim. No authentication is required (PR:N) and the attack is fully remote over the network. The principal limiting factor is the mandatory user interaction - the victim must be induced to browse to the malicious page - and the fact that users on Firefox 158, ESR 115.43, ESR 153.5 or later are not affected.

Signals are mixed but lean toward moderate real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1 High) describes a low-complexity, network-reachable, unauthenticated flaw whose only gating factor is user interaction - characteristic of a drive-by browser exploit. However, the exploitation-probability signals are low: EPSS is 0.16% (4th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is a signal conflict worth flagging: the input Tag labels this 'Information Disclosure' and CVSS sets A:N, yet the root cause is CWE-670 JIT miscompilation (type confusion / incorrect control flow in the JavaScript engine), a bug class that frequently escalates to memory corruption and remote code execution - the C:H/I:H rating is consistent with more than pure read-only disclosure, so treat the 'Information Disclosure' label as possibly understating impact. No SSVC decision record was provided in the input, so automatable/technical-impact framing cannot be cited as confirmed. Net: this is a legitimately patch-worthy High-severity browser flaw in a ubiquitous product, but current telemetry (low EPSS, no KEV, no POC) indicates it is not yet under active or widespread exploitation - prioritize via normal browser patch cadence rather than emergency response.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) containing crafted JavaScript that triggers the JIT miscompilation when a victim using an unpatched Firefox visits it. The resulting type confusion lets the attacker read sensitive data out of browser process memory, potentially as a stepping stone to further compromise. No public exploit code is identified at time of analysis, and successful attack requires the victim to actively load the attacker-controlled content (UI:R).