Mozilla Firefox CVE-2026-120572

Exploitation requires the victim to load attacker-controlled web content in an unpatched Firefox (prior to 159.0.1) so that the Block and Inline layout component processes it - this is the user-interaction requirement reflected by UI:R. No authentication is needed (PR:N) and default configurations are affected, as this is core layout/rendering code rather than an optional feature. The principal limiting factor is that the attacker cannot proceed without a user action (visiting or opening malicious content); SSVC also reports the attack is not automatable, so mass, hands-off exploitation is unlikely. The specific configuration or input that triggers the boundary error is not described in the available sources.

This is a genuine high-priority issue but not an emergency by the input signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw with total impact to confidentiality, integrity and availability, consistent with the SSVC reading of Technical Impact: total. However, the vector requires user interaction (UI:R), and SSVC reports Exploitation: none and Automatable: no, which temper the raw severity: this is a client-side browser bug that needs a victim to load attacker-controlled content and cannot be sprayed automatically across hosts. The vuln.today decision label is 'this_week' (not act_now/emergency). The CVE is not listed in CISA KEV, no EPSS score was provided in the input, and the only references are the Mozilla advisory (MFSA2026-123) and the Bugzilla ticket - no exploit code. So there is no evidence of active exploitation and no public PoC; priority rests on the high technical impact of a browser memory-corruption bug rather than on observed attacks. Note EPSS is absent, so exploitation probability cannot be weighed here.

An attacker hosts a malicious web page that exercises the incorrect boundary conditions in Firefox's Block and Inline layout code; when a victim using an unpatched Firefox visits the page, the memory corruption is triggered. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with C:H/I:H/A:H, no authentication is needed but the victim must load the content, and the precise trigger mechanism is not described in the available sources. No public exploit was identified at time of analysis.