Mozilla Firefox CVE-2026-109756

Exploitation requires the victim to use an unpatched Firefox (prior to version 158) or Firefox ESR (prior to 153.5) and to load attacker-controlled web content that exercises the DOM Navigation component - this user interaction (UI:R) is the primary limiting factor, meaning the attacker must induce the victim to visit a malicious or compromised page rather than exploit passively. No authentication is required of the attacker (PR:N) and no special victim-side configuration is indicated in the available data; the condition is simply running a vulnerable version and rendering hostile content. Patching to Firefox 158 or ESR 153.5 fully removes the exposure.

This is a genuinely high-severity issue but the signals are mixed on real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction, with total loss of confidentiality, integrity, and availability - consistent with the SSVC 'Technical Impact: total' judgment. However, SSVC also reports 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not evidence of current active exploitation. Note a tension worth flagging: the vulnerability is labeled 'Privilege Escalation' (CWE-269) yet carries PR:N and AV:N, which is typical of browser sandbox/privilege-boundary escapes where web content (not a local user) gains elevated capability - this is not a conventional local-user privilege escalation, so 'privilege escalation' here means a web-origin crossing a trust boundary within Firefox. Overall this is a real priority to patch due to ubiquity of Firefox and total technical impact, but current threat telemetry (no KEV, no POC, non-automatable, UI required) argues against imminent mass exploitation.

An attacker hosts or compromises a web page containing crafted content that abuses the DOM Navigation component; a victim running an unpatched Firefox simply visits the page (the UI:R user interaction). Successful exploitation lets the web content cross a privilege boundary, potentially leading to escape of normal web-content restrictions and total compromise of the browser process. No public exploit code has been identified at time of analysis.