Mozilla Firefox CVE-2026-8957

Exploitation requires (1) the victim to be running a vulnerable Firefox release prior to version 151 or Firefox ESR prior to 140.11, (2) the Enterprise Policies component to be active in the user's deployment - typically an organization-managed browser with policy enforcement configured, and (3) user interaction with attacker-controlled content (CVSS UI:R), such as clicking a link or loading a malicious page. No authentication to the browser or to any service is required (PR:N), and the attack vector is network-based (AV:N), but the dependence on Enterprise Policies being deployed limits exposure primarily to managed enterprise endpoints rather than default consumer installations.

Risk signals are mixed and warrant careful interpretation. CVSS v3.1 of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity, unauthenticated exploitation requiring user interaction, with high impact across confidentiality, integrity, and availability. However, EPSS is extremely low at 0.03% (9th percentile), and CISA's SSVC framework rates exploitation as 'none' with technical impact only 'partial' - directly conflicting with the CVSS 'High' impact scoring on all three CIA dimensions. SSVC does flag the issue as 'automatable: yes', suggesting that if an exploit were developed it could scale. The vulnerability is not listed in CISA KEV, and no public exploit identified at time of analysis. The discrepancy between CVSS 'High' impact and SSVC 'partial' impact suggests the practical privilege escalation may be bounded (e.g., escaping policy restrictions rather than full OS-level code execution); defenders should treat this as a standard browser-patching priority rather than an emergency, but patch promptly given the 'automatable' SSVC flag.

An attacker hosts a malicious web page or compromises a site visited by an enterprise-managed Firefox user; when the user navigates to the page (satisfying the UI:R requirement), crafted content interacts with the Enterprise Policies component to bypass or elevate privileges beyond what the policy permits. The attacker could then disable security policies, exfiltrate data the policies were protecting, or modify the browser environment to facilitate follow-on attacks. No public exploit identified at time of analysis, but SSVC marks the issue as automatable, meaning a working exploit could be scaled across many users.