Red Hat CVE-2026-4726

Remote unauthenticated attacker can trigger denial-of-service by sending crafted XML content to Firefox < 149. The victim must open or view the malicious XML in Firefox (via email attachment, web link, or file). Default Firefox installations are vulnerable; no special configuration required.

The real-world risk of this vulnerability is moderate to high despite missing CVSS and EPSS metrics. The attack vector is network-based (requires malicious XML to be delivered to the victim), and no special privileges are required—any website or attacker-controlled content can trigger the vulnerability. The denial-of-service impact is confirmed by the CVE description, meaning an attacker can reliably crash Firefox or degrade user experience. The vulnerability is not listed as actively exploited in known exploit databases (KEV status unknown), but the presence of a public Mozilla bug tracker reference and formal security advisory indicates Mozilla has high confidence in the vulnerability's validity. The fact that Firefox 149 is the remediation threshold suggests this is a recent discovery with coordinated disclosure. Without EPSS or POC data, exploitation complexity cannot be quantified, but XML-based DoS attacks are typically trivial to execute once a parsing flaw is identified. Priority should be HIGH for users whose workflows depend on Firefox stability and who are exposed to untrusted XML content (developers, researchers, users visiting malicious sites).

An attacker hosts a malicious web page containing specially crafted XML markup or serves a poisoned XML file (e.g., via email attachment or instant messaging) designed to trigger the parsing vulnerability. When a Firefox user visits the page or opens the file in their browser, the XML parser crashes, causing Firefox to crash or hang. The attacker gains a denial-of-service effect with minimal effort—no special privileges, authentication, or user interaction beyond opening a link is required. If chained with other vulnerabilities, this could serve as a stepping stone for more severe attacks such as sandbox escape or information disclosure.