Mozilla Firefox CVE-2026-109735

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Firefox build (prior to version 158) that exercises the DOM Animation component - consistent with the CVSS UI:R requirement. No authentication is required (PR:N, so unauthenticated), and no special non-default configuration is indicated; standard web browsing with JavaScript/animation rendering enabled is sufficient. The limiting factor is the mandatory user interaction: the attack cannot succeed without the user actively visiting or rendering malicious content, which prevents automated mass exploitation (SSVC Automatable=no). Impact is limited to partial confidentiality/integrity (information disclosure from freed memory) with no demonstrated availability impact.

This is a moderate-severity memory-safety bug (CVSS 5.4) whose real-world priority is low-to-moderate, and multiple independent signals agree on that. CVSS shows a network vector with low complexity and no privileges (AV:N/AC:L/PR:N) but critically requires user interaction (UI:R) - the victim must load attacker-controlled content in Firefox. CISA's SSVC framework reinforces the lower urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be mass-scripted, consistent with the UI:R requirement), and Technical Impact=partial (matching the C:L/I:L/A:N partial-impact profile). There is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active exploitation or available exploit code. The impact is bounded: the Use-After-Free (CWE-416) is tagged Information Disclosure, suggesting out-of-bounds memory read rather than reliable remote code execution, and the A:N rating indicates no demonstrated crash/DoS impact in the scoring. No signals conflict here - every source (CVSS, SSVC, absence of KEV/POC) points to a browser memory bug that is a routine patch-and-move-on item rather than an emergency. The main caveat is inherent to UAF bugs: memory-corruption primitives can sometimes be escalated beyond the vendor's initial C:L/I:L scoring if chained with other issues, so the C:L/I:L rating may understate worst-case potential.

An attacker hosts a malicious web page containing crafted DOM Animation operations and lures a Firefox user (pre-158) to visit it, for example via a phishing link or a malicious ad. When the page triggers the use-after-free in the Animation component, the attacker can read fragments of freed heap memory, potentially leaking sensitive in-process data. No public exploit code is known, and successful exploitation depends on the victim actively loading the attacker's content.