Mozilla Firefox CVE-2026-109769

Exploitation requires a victim running an unpatched Firefox (prior to version 158) to interact with attacker-controlled web content (UI:R) - typically visiting a malicious page that exercises the Networking: Cache component; no authentication or elevated privileges are needed on the target (PR:N). The practical limiting factors are: (1) mandatory user interaction, so there is no silent drive-by against a passive user without some engagement; (2) impact is confined to disclosure of a limited amount of information (C:L, no integrity or availability effect); and (3) exposure is eliminated by upgrading to Firefox 158. No non-default configuration is called out in the advisory, so default Firefox installations below 158 are affected.

This is a genuinely low-priority issue despite being a browser vulnerability in a ubiquitous product. The signals are consistent and point the same direction: CVSS 3.1 base score is 4.3 (Medium) driven by network vector (AV:N), low complexity (AC:L), and no privileges (PR:N), but capped by the requirement for user interaction (UI:R) and limited to low confidentiality impact only (C:L/I:N/A:N) - an information-disclosure flaw in the Networking: Cache component (CWE-200). CISA's SSVC framework corroborates low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis. EPSS score was not provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a data gap, not a signal of low risk per se. No signals conflict here: a modest-scope read primitive requiring a victim to interact with attacker-controlled content, in a product that is patched (Firefox 158). The one caveat is breadth of exposure - because Firefox is deployed on a huge number of endpoints, even a low-severity flaw warrants routine patching, but it does not warrant emergency prioritization.

An attacker lures a Firefox user to a malicious or compromised web page that exercises the Networking: Cache component to leak a limited amount of information the attacker should not be able to read (e.g., cache-state or cross-origin resource metadata). Because user interaction is required (UI:R), the victim must visit or interact with attacker-controlled content; no exploit code is publicly known at time of analysis, so weaponization would require original research.