Mozilla Firefox CVE-2026-109749

Exploitation requires the victim to use an affected Firefox version (prior to the fixed build, cited as Firefox 158 / mfsa2026-106) and to load attacker-controlled web content that exercises the WebAssembly engine - the WASM/JavaScript code path must be reachable, which it is by default in standard browsing. The key limiting factor is mandatory user interaction (UI:R): the attacker cannot exploit a passive or idle browser and must induce the user to visit a malicious or compromised page, which also means the flaw is not automatable for worm-like mass exploitation (SSVC Automatable=no). No authentication is required (PR:N). Impact is bounded to partial confidentiality/integrity effects within the browser process (S:U, no scope change).

This is a moderate-severity, memory-safety issue that the aggregate signals consistently rate as low real-world priority rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless REQUIRES user interaction (UI:R) - i.e., the victim must browse to or load attacker-controlled content - and yields only low confidentiality and integrity impact with no availability impact. CISA's SSVC framing reinforces the low-urgency read: Exploitation=none (no observed exploitation), Automatable=no (user interaction blocks mass/automated exploitation), Technical Impact=partial. No CISA KEV listing and no EPSS score were provided, and no public proof-of-concept is referenced; therefore there is no public exploit identified at time of analysis. The signals are mutually consistent - nothing here is conflicting - so the honest conclusion is that this is a real but low-to-moderate browser memory-safety bug, already patched, not a high-urgency item. One caveat worth noting for verification: the CVSS vector sets A:N, yet use-after-free (CWE-416) bugs in a JIT/WebAssembly engine commonly produce crashes, so the real availability impact may be slightly understated; this does not change the overall low-priority assessment.

An attacker hosts a malicious web page containing crafted WebAssembly/JavaScript that triggers the use-after-free in Firefox's WebAssembly component and lures a victim into visiting it (UI:R). Successful exploitation could disclose small amounts of in-process memory or corrupt memory to influence integrity (C:L/I:L). No public exploit code is referenced, and exploitation requires the victim to actively load attacker content, limiting scale.