Mozilla Firefox CVE-2026-109757

Exploitation requires the victim to load attacker-controlled web content in Firefox (UI:R - no victim action, no exploitation), and then requires the attacker to win a timing-dependent race condition in the Networking component, which high attack complexity (AC:H) indicates is not reliably achievable per attempt. No authentication is required (PR:N, unauthenticated). The principal limiting factors are the mandatory user interaction, the probabilistic nature of the race window, and the need for the user to be running an unpatched version prior to Firefox 158 / ESR 153.5; there is no special non-default configuration called out in the description.

This is a high-severity (CVSS 8.3) sandbox escape in Firefox's Networking component triggered by a race condition (CWE-362). The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H is internally consistent with a browser-rendered attack: network delivery (AV:N), no authentication (PR:N), required user interaction (UI:R, i.e. the victim loads attacker content), and a scope change (S:C) reflecting the break out of the content sandbox into the host, yielding full confidentiality, integrity, and availability impact. The high attack complexity (AC:H) is the dominant mitigating signal and is well-grounded: winning a race condition reliably is timing-dependent and not guaranteed per attempt. Exploitation signals are LOW and mutually reinforcing: EPSS is only 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis - so there is no evidence of active exploitation or available weaponization. The tension here is severity vs. likelihood: raw impact is critical-adjacent, but the real-world probability signals (low EPSS, no KEV, no POC, AC:H) argue this is a serious-but-not-emergency patch priority rather than an actively exploited crisis. Prioritize patching because the affected product is a ubiquitous browser and sandbox escapes are high-value, but there is no indication this warrants out-of-band emergency response based on current data.

An attacker hosts or injects malicious web content and lures a victim into loading it in Firefox; the content drives the vulnerable Networking code path to win a timing-dependent race condition, corrupting state and escaping the content sandbox to run code with the host browser process's privileges. Because attack complexity is high, exploitation is not reliable on a single attempt and may require repeated triggering. No public exploit code has been identified at time of analysis.