Mozilla Firefox EUVD-2026-30905

Victim must use an unpatched Firefox prior to 151 or Firefox ESR prior to 140.11, and must interact with attacker-controlled web content that instantiates a DOM Worker (UI:R per CVSS vector - typically visiting a malicious page or clicking through to attacker-controlled content). No authentication to the browser or any target service is required (PR:N). Exploitation is limited by the required user interaction and the need for the victim's browser to load JavaScript from an attacker-influenced origin; environments that whitelist trusted sites, block third-party scripts, or run Firefox in restricted profiles materially reduce exposure.

Signals are mixed but skew toward moderate real-world risk. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-reachable exploitation with no privileges required, low attack complexity, and high triad impact - but user interaction is required, meaning a victim must visit or interact with attacker-controlled content. EPSS is very low at 0.03% (9th percentile), and CISA SSVC reports Exploitation: none and Technical Impact: partial (not total), though Automatable: yes suggests the exploit could be embedded into drive-by web content at scale once weaponized. The vulnerability is not on the CISA KEV list and no public exploit is identified. Notably, SSVC's 'partial' technical impact appears to conflict with CVSS C:H/I:H/A:H - verify scope against the Mozilla advisory, as the privilege escalation likely remains bounded within the browser process rather than reaching the host OS. Overall this is a meaningful browser patch priority but not an emergency.

An attacker hosts a malicious web page (or compromises an ad network or third-party script) containing crafted JavaScript that abuses the DOM Workers privilege management flaw. When a victim using an unpatched Firefox or Firefox ESR browser visits the page or interacts with the embedded content, the worker context escalates its privileges within the browser, allowing the attacker to access data, manipulate browser state, or further compromise the session. No public exploit is identified at time of analysis.