Mozilla Firefox EUVD-2026-60660

Exploitation requires the victim to be running an unpatched Firefox version (any release prior to Firefox 154, ESR 140.14, or ESR 153.1) and to actively navigate to or be redirected to an attacker-controlled web page while holding active sessions on target websites - the UI:R designation confirms this browser navigation is mandatory, preventing fully server-side or automated exploitation. No attacker authentication or elevated privileges are required (PR:N). Exploitation is bounded to the browser's cookie store: the attacker cannot directly access the underlying operating system or files. Websites deploying HttpOnly cookie flags limit confidentiality exposure by preventing JavaScript-side cookie reads, though integrity impact via cross-site cookie writes may still apply. Non-default configurations are not required - any default Firefox installation browsing to a malicious page is susceptible.

The CVSS 8.1 High score is well-supported: the attack is network-reachable (AV:N), low-complexity (AC:L), requires no privileges (PR:N), and delivers high confidentiality and integrity impact (C:H/I:H) - cookies routinely carry session tokens, CSRF tokens, and authentication credentials, making theft or manipulation directly actionable for session hijacking or account takeover. The UI:R requirement (victim must navigate to an attacker-controlled page) is the primary friction point, ruling out fully autonomous mass exploitation; even a mid-sized municipal IT team in tczew should treat this as an urgent patching priority given the session-hijacking potential for any staff using Firefox against internal web applications. No EPSS score was provided in the input data, so exploitation probability cannot be quantified statistically; however, the absence of a KEV listing and public POC suggests no confirmed widespread in-the-wild exploitation at analysis time. The scope-unchanged (S:U) rating correctly constrains impact to the browser session, not the underlying OS.

An attacker hosts a malicious webpage containing JavaScript that triggers the origin validation error in Firefox's cookie component; when an authenticated victim visits the page - via a phishing link, malicious advertisement, or compromised website - the attacker's code reads or overwrites the victim's session cookies for a targeted application such as a corporate SSO portal or webmail, enabling account takeover. No public POC is identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack requires only a single browser navigation with no additional exploitation prerequisites.