Mozilla Firefox CVE-2026-109771

Exploitation requires the victim to use a vulnerable Firefox build prior to version 158 and to interact with attacker-controlled web content that drives the WebRTC: Networking component (CVSS UI:R), meaning WebRTC must be reachable/active in the browsing session. No authentication is required of the attacker (PR:N), but the mandatory user interaction and the limitation of impact to a partial confidentiality leak (C:L/I:N/A:N) substantially constrain realistic risk; upgrading to Firefox 158 fully removes the condition.

This is a genuinely low-priority issue despite the 'Medium' CVSS 4.3 rating. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) describes a network-reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R) and yields only low-magnitude confidentiality impact with no integrity or availability effect - consistent with CWE-200 information disclosure in the WebRTC networking stack. All exploitation signals point the same direction and reinforce low risk: CISA SSVC lists Exploitation as 'none', Automatable 'no', and Technical Impact only 'partial'. No CISA KEV listing is present and no EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified but nothing suggests it. No public exploit identified at time of analysis. There is no conflict between the signals here - the modest CVSS, the SSVC 'none/no/partial' triad, and the absence of KEV/POC all agree. The only caveat is that EPSS data is missing from the input, so the exploitation-probability dimension is unverified rather than confirmed-low.

An attacker hosts a malicious web page that establishes or manipulates a WebRTC networking session; when a victim using a pre-158 Firefox build visits the page and interacts with it (UI:R), the flaw leaks a limited amount of sensitive information such as internal network or memory-resident data. No public exploit is identified and impact is confined to partial confidentiality disclosure, with no code execution or data tampering.