Mozilla Firefox CVE-2026-109729

Exploitation requires the victim to load attacker-controlled web content (UI:R) that exercises Firefox's JavaScript JIT compilation path - i.e., the JIT must be enabled, which is the default. No authentication or prior privileges are needed (PR:N), and the attack is network-delivered (AV:N) against default Firefox configurations. Key LIMITING factors: the mandatory user interaction (the user must actively visit or be redirected to a malicious page), the scope being unchanged (S:U, confined to the browser process), and the limited impact (C:L/I:L, no availability impact), which together bound realistic risk well below that of a fully unauthenticated zero-click RCE.

This is a moderate-severity memory-safety flaw (CVSS 5.4) that is unlikely to be a top patching priority despite affecting a ubiquitous browser. Multiple signals agree it is NOT an urgent threat: it is not in CISA KEV, no public exploit code was identified, and CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reinforces this - while network-reachable and unauthenticated, it requires user interaction (victim must load malicious web content) and yields only Low confidentiality and Low integrity impact with no availability impact. Note a tension worth flagging: the CWE is CWE-416 (use-after-free), a class that frequently enables full remote code execution, yet both the vendor CVSS and SSVC Technical Impact constrain this specific instance to partial/low impact - this suggests the UAF is exploitable only for limited memory disclosure (consistent with the 'Information Disclosure' tag) rather than reliable code execution, OR that the impact rating is conservative. Bottom line: a real but non-critical issue; patch in the normal browser update cycle, not as an emergency.

An attacker hosts a malicious web page containing crafted JavaScript that triggers a use-after-free condition in Firefox's JIT compiler when the victim visits the page. Because UI:R applies, the attacker must lure the user to the page (e.g., via phishing, malvertising, or a compromised site); successful exploitation could leak limited process memory or corrupt limited state. No public proof-of-concept exploit was identified at time of analysis.