Mozilla Firefox EUVD-2026-37104

User interaction is required - specifically, the targeted user must visit or be redirected to an attacker-controlled web page or open attacker-supplied content within the Firefox browser (UI:R). No authentication to any service is required from the attacker's perspective (PR:N), and no special non-default Firefox configuration is identified as a prerequisite; the vulnerability exists in the core Process Sandboxing component present in standard Firefox installations. Exploitation is limited by the need for per-user engagement (not automatable per SSVC), meaning bulk or worm-style propagation without user interaction is not feasible. The impact ceiling is also constrained: only confidentiality is affected (C:L), so attackers cannot modify data or crash the browser through this path alone. Exploitation is further limited to Firefox versions prior to 152 and ESR versions prior to 140.12 on all supported desktop platforms.

The CVSS base score of 4.7 (Medium) reflects a network-reachable, scope-changing flaw requiring only user interaction and no privileges, but with a limited confidentiality-only impact and no integrity or availability consequence. The scope change (S:C) elevates theoretical concern because it represents a true sandbox boundary violation, but C:L caps practical damage. EPSS data was not provided, limiting probabilistic exploitation forecasting. SSVC assessment further reduces urgency: exploitation status is none, the attack is not automatable (UI:R enforces a per-user engagement requirement), and technical impact is partial - meaning no full system compromise is indicated. No KEV listing confirms this is not known to be actively exploited at time of analysis. No POC is referenced in supplied intelligence. Overall, this is a moderate-priority patch, important because sandbox escapes represent architectural trust boundary violations, but not an emergency given limited scope of data exfiltration and absence of exploitation signals.

An attacker hosts a malicious webpage that, when visited by a Firefox user on any affected version, triggers improper privilege handling within the Process Sandboxing component. Through this sandbox escape, the attacker's content-layer code gains read access to data or resources outside the browser sandbox - such as files, environment variables, or memory belonging to the host process - and can exfiltrate this information to an attacker-controlled server. No public exploit code is referenced in the available intelligence.