Mozilla Firefox CVE-2026-16366

The specific prerequisite is that the victim runs a Mozilla Firefox version earlier than 153 and processes attacker-influenced content through the DOM Navigation component - i.e., loads or navigates to a page under attacker control. The vendor CVSS marks UI:N (no user interaction) and PR:N (unauthenticated), which would mean no special conditions beyond reaching the browser; however, for a client-side browser DOM bug this is almost certainly limiting-factor-dependent: exploitation realistically requires the user to visit or be redirected to malicious web content, and is limited to the Firefox desktop application. No server-side or default-listening-service exposure exists - the attack surface is the browser rendering attacker-supplied pages.

The signals conflict. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) implies fully remote, unauthenticated, no-interaction compromise, but that is inconsistent with a browser DOM Navigation bug, which almost always requires the victim to visit or interact with attacker-controlled web content (UI:R) - verify the UI:N assumption with Mozilla, as it likely overstates real-world exploitability. Countervailing the high CVSS, the EPSS score is very low (0.14%, 4th percentile), the CVE is not on CISA KEV, and no POC or in-the-wild activity is referenced, so this is not confirmed active exploitation. SSVC-style reasoning: exploitation status is 'none observed,' automatability is low (client-side, victim-driven), but technical impact is potentially high (privilege escalation). Net: patch promptly given the high theoretical impact and ubiquity of Firefox, but this reads as a high-CVSS bug without evidence of imminent mass exploitation rather than an emergency.

An attacker hosts a malicious web page containing crafted JavaScript that abuses the DOM Navigation component's flawed privilege handling; when a victim on a pre-153 Firefox visits the page, the content escalates its privileges beyond the normal web-content sandbox. Given AV:N/AC:L, the delivery is trivial (a link or malvertisement), though realistic exploitation almost certainly requires the victim to load the page despite the vendor vector listing UI:N. No public exploit code is identified at time of analysis.