Mozilla Firefox CVE-2026-109776

Exploitation requires a user to visit or interact with attacker-controlled web content (UI:R) rendered by a vulnerable Firefox build, and the attacker must successfully win a non-deterministic timing race in the XPCOM component (reflected in AC:H), which cannot be triggered reliably on demand. No authentication is required (PR:N). Exploitation is limited to versions prior to Firefox 158 and Firefox ESR 153.5; updated builds are not affected. Impact is constrained to limited information disclosure (C:L/I:L, A:N), with no scope change (S:U), so even on success the attacker gains only small, partial access rather than code execution or full compromise.

This is a genuinely low-priority issue by most signals, and they are internally consistent. The CVSS 3.1 base score of 4.2 (Medium) reflects a hard-to-win condition: AV:N but AC:H (winning a race window is non-deterministic), UI:R (victim must perform some browsing action), and only partial, unchanged-scope impact (C:L/I:L/A:N). EPSS reinforces this - 0.19% probability at the 8th percentile indicates very low expected exploitation volume. The vulnerability is NOT on CISA KEV and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. The only mild tension is between AV:N (network) and the practical reality of exploiting a XPCOM race condition, which requires precise timing against a browser process; the AC:H metric already captures that difficulty, so the signals do not actually conflict. Overall this is a legitimately low-urgency, low-real-risk flaw that should be remediated via normal Firefox update cadence rather than emergency patching.

An attacker hosts or compromises a web page and lures a Firefox user to visit it (UI:R). The page performs timed operations that attempt to trigger a race condition in the XPCOM component, and on a successful race the attacker gains limited read access to small amounts of in-process data (C:L). No public exploit code is referenced, and the high attack complexity (AC:H) means success is probabilistic rather than reliable.