Mozilla Firefox CVE-2026-109733

Exploitation requires the victim to use an affected, unpatched version of Mozilla Firefox (or Firefox ESR) and to load attacker-controlled web content that executes JavaScript through the JIT compiler - the UI:R metric confirms user interaction (navigating to or rendering a malicious page) is mandatory. No authentication is required (PR:N), and the attack works remotely against default Firefox configurations with JavaScript enabled, but it cannot be triggered without the user visiting hostile content, and it is limited to users still running versions prior to the fixes (Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 per the advisory). The scope is unchanged (S:U), so impact is confined to the browser process and its accessible memory rather than the broader host.

This is a genuinely serious but not emergency-tier browser flaw. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1) describes a network-reachable, low-complexity, unauthenticated vulnerability that nonetheless REQUIRES user interaction - the victim must load attacker-controlled content in Firefox. The CWE-843 (type confusion) classification combined with the 'JIT miscompilation in the JavaScript Engine' description and the 'Memory Corruption'/'Information Disclosure' tags indicates a classic engine memory-safety bug that can corrupt memory and leak data (C:H/I:H) but is not described as causing denial of service (A:N). Real-world risk signals point LOWER than the raw 8.1 would suggest at present: EPSS is only 0.16% (5th percentile), there is no CISA KEV listing, and no public POC is referenced - so there is no evidence of active or imminent widespread exploitation. The tension to flag explicitly: the affected product (Firefox) is ubiquitous, which raises aggregate exposure, yet UI:R and the absence of KEV/POC mean exploitation requires luring users to malicious pages and currently remains theoretical. Priority is high for patch management (browsers are prime targets and JIT type-confusion bugs are historically weaponizable), but this is NOT a confirmed-exploited drop-everything item. One inconsistency worth noting: the fix version 'Firefox ESR 115.43' alongside 'Firefox 158' and 'ESR 153.5' is unusual ESR numbering - verify exact fixed versions against the specific Mozilla MFSA advisory before remediation.

An attacker hosts a malicious web page containing crafted JavaScript that triggers the JIT compiler to miscompile code, producing a type confusion in the JavaScript engine. When a victim running an unpatched Firefox visits the page, the engine corrupts memory, allowing the attacker to read sensitive process memory and potentially manipulate execution (C:H/I:H). No public exploit code is identified at time of analysis, and successful exploitation depends on the victim opening the attacker's content (UI:R).