Mozilla Firefox CVE-2026-109738

Exploitation requires the victim to use an affected Firefox version (prior to Firefox 158 or ESR 153.5) and to actively load attacker-controlled content that is processed by the Audio/Video Playback component - i.e., visiting a malicious or compromised page that serves crafted media (UI:R). No authentication or prior privileges are needed (PR:N), but the mandatory user interaction and the need for the media pipeline to process the crafted content limit this to targeted or opportunistic drive-by delivery rather than automated mass exploitation (SSVC Automatable=no). Impact is bounded to partial memory disclosure/corruption; there is no availability impact and no confirmed path to full code execution from the input data.

This is a moderate-severity browser memory-safety bug, not a top-tier emergency. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects a network-reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R) and yields only partial confidentiality and integrity impact with no availability impact - consistent with a use-after-free (CWE-416) that leaks or minimally corrupts heap memory rather than granting reliable code execution. CISA's SSVC decision framework agrees this is low-priority: Exploitation=none (no observed exploitation), Automatable=no (requires luring a victim to render crafted media, so it cannot be mass-sprayed), and Technical Impact=partial. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or imminent exploitation. Per precision rules this is: no public exploit identified at time of analysis, and the product is NOT in CISA KEV. The signals are internally consistent - modest CVSS, no exploitation, non-automatable - so this is a routine patch-cycle item rather than an out-of-band priority. The main caveat: use-after-free bugs in browser media stacks are historically chainable with other primitives into higher-impact exploits, so prioritize patching on high-exposure endpoints even though standalone risk is moderate.

An attacker hosts a web page containing specially crafted audio or video content and lures a Firefox user to visit it (UI:R). When the Audio/Video Playback component processes the media, the use-after-free is triggered, allowing the attacker to read small amounts of adjacent heap memory or influence process state, potentially leaking sensitive in-process data. No public exploit code was identified in the provided intelligence, and SSVC marks the issue as not automatable.