Mozilla Firefox CVE-2026-8972

Exploitation requires the victim to be running Firefox earlier than 151 and to interact with attacker-controlled web content that drives the WebRTC Audio/Video component (UI:R in the CVSS vector) - typically clicking a link to a malicious page and, depending on the WebRTC call path used, accepting a media permission prompt. No prior authentication to the target is needed (PR:N) and attack complexity is low (AC:L), but the limiting factors are concrete: the user must actively visit hostile content, WebRTC must be enabled in the profile (the default), and the browser must not yet have been updated past 151. Browsers other than Firefox and Firefox builds already on 151 or newer are out of scope.

Signals diverge meaningfully here: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 8.8 (High) and SSVC marks the issue as Automatable=yes with partial technical impact, yet EPSS is only 0.03% (8th percentile) and SSVC Exploitation=none, with no KEV entry and no public exploit identified at time of analysis. The UI:R component is the principal mitigant - the victim must visit or interact with attacker-controlled content - and combined with the lack of observed exploitation suggests this is a real but not urgent priority compared with KEV-listed browser bugs. One conflict worth flagging: the description characterises this as 'privilege escalation' while the CVSS vector is AV:N with PR:N, indicating the elevation occurs inside the browser sandbox/origin model rather than to OS-level privileges - verify scope with the Mozilla advisory before treating as a host-level EoP.

An attacker hosts a malicious site (or compromises a third-party script loaded by one) that initiates a WebRTC session as soon as the victim, using a pre-151 Firefox build, visits the page and accepts the camera/microphone or other media prompt. The crafted SDP exchange or media pipeline interaction triggers the improper privilege management flaw, granting the attacker elevated capabilities inside the browser context with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis, but SSVC marks the issue as automatable, so a working proof-of-concept could be scripted into a drive-by kit once details surface.