Mozilla Firefox CVE-2026-109741

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Firefox build (before 158, or ESR before 153.5) and requires that content to exercise the Storage Bucket File System API (the Origin Private File System / bucket storage feature) to trigger the use-after-free. Key limiting factors: user interaction is mandatory (UI:R) - there is no server-side or passive network exploitation; the bug is in a specific storage subsystem rather than always-on parsing, so the attacker must drive that API; and as a use-after-free, reliable triggering typically depends on specific heap state and timing. No authentication is required (PR:N, unauthenticated), and default configurations are affected since the storage API is generally available.

This is a moderate-severity, low-priority issue despite being a memory-corruption bug in a ubiquitous browser. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must visit attacker-controlled web content. CISA's SSVC decision framework reinforces the low-urgency reading: Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a 'Track' rather than 'Act' disposition. No CISA KEV listing and no public exploit were provided in the intelligence, so this is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting: a UAF (CWE-416) rated only C:L/I:L/A:N by the vendor suggests this was assessed as an information-disclosure / limited memory-read primitive, not a demonstrated remote-code-execution path, which aligns with 'Technical Impact: partial.' The main caveat is inherent to the class: use-after-free bugs are sometimes upgradeable to code execution through heap grooming, so the vendor's A:N/partial rating reflects known impact, not a guarantee of the ceiling. Overall this is a 'patch in normal cycle' browser bug, not an emergency.

An attacker hosts a malicious web page (or injects script into a compromised/ad-served context) that drives the Storage Bucket File System API through a sequence of operations that frees and then reuses an object. When a victim visits the page with a vulnerable Firefox build, the dangling reference is dereferenced, letting the attacker read residual heap memory and potentially leak sensitive in-process data. No public proof-of-concept was identified at time of analysis, and successful exploitation requires the user to load the attacker's content.