Mozilla Firefox CVE-2026-8952

Exploitation requires the Firefox Application Update component to be present and enabled (the default in standard Firefox installations using auto-updates and, on Windows, the Mozilla Maintenance Service) and requires user interaction per the CVSS UI:R flag - typically navigating to or interacting with attacker-controlled content in Firefox. Authentication is not required (PR:N), but exploitation is limited to systems running a vulnerable Firefox build prior to version 151 with the updater enabled; environments that disable auto-updates or run Firefox from a read-only/managed install (e.g., enterprise MSI deployments with the updater disabled via policy) are not exposed via the auto-update path. The terseness of the public description means the exact triggering surface is not enumerated; defenders should treat any Firefox pre-151 with the updater active as exposed.

Signals are mixed and lean lower than the raw CVSS suggests. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 8.8, but the network attack vector is unusual for a privilege escalation in an update component - privilege escalation flaws are typically local, so the AV:N rating likely reflects that exploitation begins via web-delivered content the user must interact with (UI:R). EPSS at 0.03% (8th percentile) and CISA SSVC reporting Exploitation: none, Automatable: yes, Technical Impact: partial all indicate this is not currently a priority exploitation target. There is no public exploit identified at time of analysis and the CVE is not on the CISA KEV list. The SSVC 'partial' technical impact also conflicts with the CVSS 'High' ratings across C/I/A - vendors and CISA may be assessing real-world impact more conservatively. Net assessment: patch on normal cadence; this is unlikely to be opportunistically exploited but the AV:N rating warrants verification with Mozilla's MFSA bulletin since the description is unusually terse.

An attacker hosts a malicious web page that, when visited by a Firefox user, triggers logic in the Application Update component to perform a privileged action under attacker influence - for example, staging or replacing an update payload that the elevated updater service later executes. After the user takes the required interaction (UI:R), the attacker gains code execution with the privileges of the updater. No public exploit code or active exploitation has been reported at the time of analysis.