What is the CVSS score of CVE-2026-8952?

CVE-2026-8952 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mozilla Firefox are affected by CVE-2026-8952?

Mozilla Firefox users face a privilege escalation vulnerability in the Application Update component (CVE-2026-8952, CVSS 8.8) that could allow remote attackers to gain elevated system access when…. A patch is available.

Mozilla Firefox CVE-2026-8952

EUVD-2026-30902 HIGH

Improper Privilege Management (CWE-269)

2026-05-19 mozilla

GHSA-hrqc-vwff-62mj

Privilege Escalation Mozilla Suse

8.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:23 vuln.today

Severity Changed

May 20, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

May 20, 2026 - 17:22 NVD

6.5 (MEDIUM) 8.8 (HIGH)

CVE Published

May 19, 2026 - 12:29 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151.

AnalysisAI

Privilege escalation in Mozilla Firefox via the Application Update component allows remote attackers to gain elevated privileges when a user interacts with malicious content, fixed in Firefox 151. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R) and is categorized under CWE-269 (Improper Privilege Management). …

RemediationAI

Within 24 hours: Inventory all Firefox installations organization-wide and document current versions. Within 7 days: Restrict user download and execution of untrusted content; communicate the vulnerability to end users; consider temporarily disabling automatic Firefox updates pending vendor patch release. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory