Mozilla Firefox CVE-2026-109752

Exploitation requires the victim to load attacker-controlled web content in an unpatched Firefox (before 158) or Firefox ESR (before 153.5) and for that content to exercise the DOM: Workers functionality to trigger the use-after-free. The primary limiting factor is required user interaction (UI:R) - the victim must visit or be redirected to the malicious page; no authentication is needed (PR:N). No special non-default browser configuration is indicated by the available data; Web Workers are standard web-platform functionality enabled by default.

This is a moderate-severity issue that does NOT rise to urgent-priority despite affecting a ubiquitous product. All exploitation signals point low: SSVC records Exploitation='none', Automatable='no', and Technical Impact='partial', and there is no CISA KEV listing and no public exploit identified at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) confirms remote, unauthenticated reach but gates exploitation behind required user interaction (UI:R), which aligns with the browser threat model: a victim must visit attacker-controlled content. Note a tension worth flagging: the CWE is CWE-416 (use-after-free, a memory-corruption class often associated with code execution), yet the vendor-scored impact is only C:L/I:L/A:N with no availability/crash impact - suggesting Mozilla assessed this as leading to limited memory disclosure rather than reliable RCE, consistent with the 'Information Disclosure' tag. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be incorporated. Net: real but routine browser-patch priority, not an emergency.

An attacker hosts or injects a malicious web page that programmatically exercises the DOM Workers component to trigger the use-after-free. When a victim using an unpatched Firefox visits the page, the freed-then-reused memory lets the attacker read adjacent heap contents, potentially leaking sensitive in-process data. No public proof-of-concept is identified at time of analysis, and exploitation requires the victim to load attacker-controlled content (UI:R).