Mozilla Firefox CVE-2026-109781

Exploitation requires the victim to use Firefox to render or print attacker-controlled content that reaches the Printing: Output code path, consistent with CVSS UI:R - the crash does not occur without this user-initiated action. No authentication is required (PR:N), and the vector is network-delivered (AV:N), but the mandatory user interaction and availability-only impact are the key limiting factors: there is no code execution, data exposure, or persistence, and affected builds are limited to Firefox before 158 and Firefox ESR before 153.5.

This is a moderate-severity denial-of-service issue rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity, unauthenticated condition whose sole impact is availability (A:H) with no confidentiality or integrity loss - consistent with the CWE-400 resource-exhaustion classification and the 'Printing: Output' component described by Mozilla. The required user interaction (UI:R) is a meaningful limiter: a victim must take an action (load/print malicious content) for the crash to trigger. All exploitation signals point the same direction and are low: CISA SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public exploit was identified in the provided data. No EPSS score was supplied, so widespread-exploitation probability cannot be independently quantified. The signals are internally consistent (no conflict between CVSS, SSVC, and KEV); the only gap is the absent EPSS value. Net: a browser-crash DoS worth patching in normal cycles, not an emergency.

An attacker hosts or injects web content that, when the victim renders or prints it via Firefox, drives the Printing: Output component into excessive resource consumption and crashes the browser (CWE-400). No public exploit code was identified, and exploitation yields only a crash - no code execution or data disclosure. Because user interaction is required, the attacker must lure the victim into visiting the page or triggering the print path.