Mozilla Firefox CVE-2026-109739

Exploitation requires a low-privileged execution context within Firefox's WebExtensions subsystem - in practice an installed, malicious, or compromised browser extension - that can reach the vulnerable privilege-management code path (CWE-269); it affects Firefox versions prior to 158 and is remediated by upgrading to Firefox 158. The CVSS vector states no user interaction (UI:N) and low privilege (PR:L), so beyond having the extension present no further interaction is modeled. Limiting factors: an attacker must already have a foothold as an extension (or get one installed), and the AV:N labeling is questionable for a browser extension privilege-escalation flaw - realistic exploitation is tied to the extension context rather than direct unauthenticated network reach, which should be verified with Mozilla.

Signals are mixed and point to a moderate, not emergency, priority. The Mozilla-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) yields 8.8 HIGH, implying a network-reachable, low-complexity flaw that needs only low privilege and no user interaction to fully compromise confidentiality, integrity, and availability. Against that, the exploitation signals are weak: EPSS is just 0.16% (4th percentile), the CVE is NOT on the CISA KEV list, and no public PoC is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is also an internal tension worth flagging: this is a WebExtensions-component privilege escalation (CWE-269) in a client browser, yet it carries AV:N/PR:L. For a browser extension privilege-escalation issue, the 'low privilege' most plausibly means an attacker-controlled or malicious WebExtension context rather than a remote unauthenticated network attacker, so the practical attack surface is narrower than the 8.8/AV:N score suggests - verify the exploitation model with Mozilla. Net: a legitimately high-severity browser bug that should be patched on normal urgent-browser-update cadence, but the very low EPSS and absence of KEV/PoC indicate it is not currently being exploited at scale.

A user installs or is tricked into installing a malicious or compromised Firefox WebExtension that already runs with limited privileges. The extension abuses the flawed WebExtensions privilege-management code path to escalate out of its granted permissions and execute with full browser-level privileges, gaining access to all browsing data and the ability to run arbitrary code in the browser's context. No separate public exploit is known, and no user interaction beyond having the extension present is required per the CVSS vector.