Mozilla Firefox EUVD-2026-46234

The vulnerability resides specifically in the WebExtensions framework, so exploitation is tied to extension code interacting with the privilege-management logic that improperly grants elevated capabilities (CWE-269). What limits exploitation is the extension context itself: a malicious or compromised WebExtension realistically must be loaded in the browser for the flaw to be reached, and Firefox's add-on signing plus user/enterprise approval requirements act as gating factors. Note a data conflict: the vendor CVSS states PR:N/UI:N (no privileges, no user interaction), which implies no such prerequisite - this should be verified against the Mozilla advisory, because the WebExtensions scope of the flaw suggests an extension must be present rather than pure remote unauthenticated triggering.

The signals conflict and should be weighed carefully. Mozilla assigns CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (network, low complexity, no privileges, no user interaction, unchanged scope, full C/I/A impact), which nominally describes remote unauthenticated compromise. However, a WebExtensions privilege-escalation flaw realistically presupposes that an extension is present or loaded, which is difficult to reconcile with PR:N/UI:N - this discrepancy should be verified against the Mozilla advisory before treating the flaw as remotely triggerable with no interaction. Corroborating this doubt, EPSS is very low (0.14%, 4th percentile), the CVE is not on CISA KEV, and no POC is referenced, so this reads as a high-CVSS issue without evidence of active or widespread exploitation. Given Firefox's enormous install base, patching remains a priority, but practical urgency is moderated by the absence of active-exploitation and POC signals.

An attacker publishes or compromises a Firefox add-on that abuses the WebExtensions privilege-management flaw so that, once loaded, it escalates beyond its declared permissions to read sensitive data, alter browser behavior, or perform privileged operations. Given the low attack complexity claimed by the CVSS vector, exploitation would be reliable once the vulnerable code path is reached, though no public POC has been identified.