EUVD-2026-60746
GHSA-mcwh-jxcv-xq9h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via webpage visit with UI:R for page navigation; S:U as privilege escalation stays within Firefox process, not OS; PR:N confirmed by lack of any authentication precondition.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The sole prerequisite for exploitation is that the victim uses an unpatched Firefox version and visits an attacker-controlled webpage - the CVSS UI:R metric confirms this passive user interaction is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 (High) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H signals a highly accessible attack: network-reachable, low complexity, no authentication, requiring only passive user interaction (visiting a webpage). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a website and embeds JavaScript or navigation logic crafted to trigger improper privilege handling in the DOM Navigation component. When a target Firefox user visits the page - the sole required interaction - the malicious navigation event exploits CWE-269 to escalate from web content privileges to elevated browser-internal privileges, granting the attacker full read/write access to browser state, stored credentials, session cookies, and any data accessible within the browser process. … |
| Remediation | The primary remediation is to upgrade Firefox immediately: standard release users should update to Firefox 154 or later; ESR 115.x users to Firefox ESR 115.39; ESR 140.x users to Firefox ESR 140.14; ESR 153.x users to Firefox ESR 153.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, notify all Firefox users of the vulnerability and implement temporary restrictions on Firefox usage for sensitive activities; disable Firefox plug-ins that are not essential and enable sandboxing features if available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today