Firefox PDF Viewer CVE-2026-109742

Exploitation requires the victim to open and render an attacker-crafted PDF document within Firefox's built-in PDF Viewer component (pdf.js); this maps directly to the required user interaction (UI:R) in the CVSS vector. No authentication is required of the attacker (PR:N, unauthenticated), and no special non-default configuration is indicated since the PDF viewer is enabled by default. Limiting factors that reduce real-world risk: mandatory user action to open the malicious file, scope-unchanged impact confined to the browser context, and only partial/low confidentiality disclosure (C:L) with no integrity or availability effect. Affected versions are Firefox prior to 158 and Firefox ESR prior to 153.5.

This is a moderate, low-priority issue despite being network-reachable. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects an unauthenticated, network-delivered but user-interaction-dependent information disclosure with only low confidentiality impact and no integrity or availability impact. All corroborating signals point the same direction and do not conflict: CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', which aligns with the low CVSS and the CWE-200 classification. The vulnerability is NOT on the CISA KEV list and no public exploit code was identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the input - but the combination of required user interaction (UI:R), non-automatable per SSVC, and partial/low technical impact strongly suggests this is a genuinely low-real-risk issue rather than an under-rated one. The main caveat is that the description is terse ('Information disclosure in the PDF Viewer component') and does not specify what information is exposed, so the precise sensitivity of leaked data cannot be confirmed from the input.

An attacker hosts or emails a specially crafted PDF and lures a Firefox user into opening it in the browser's built-in PDF viewer (pdf.js). When the victim views the document, the flaw causes a limited disclosure of information (e.g., memory or cross-context data) back to attacker-influenced content. No public exploit code was identified, and successful attack requires the victim to actively open the malicious file.