Mozilla Firefox EUVD-2026-60664

Exploitation requires the target to be running Mozilla Firefox in any version prior to 154 (stable), prior to 140.14 (ESR), or prior to 153.1 (ESR). The vulnerability is scoped to the Audio/Video Playback component, so the malicious page must render crafted media content to trigger the same-origin policy bypass - a plain HTML page without media elements would not be sufficient. Per the CVSS UI:R metric, user interaction is required: the target must load the attacker-controlled page or a page embedding attacker-controlled media. No authentication, elevated permissions, or non-default browser configuration is required per the PR:N metric. Exploitation is limited by unchanged scope (S:U) - the attack cannot pivot to the underlying OS or other browser processes. The partial impact ceiling (C:L/I:L) limits what can be achieved: arbitrary code execution or full cross-origin session takeover is not supported by the available data.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N yields a Medium score of 5.4, and the metrics are internally consistent with the described vulnerability. Network delivery with no privilege requirement and low attack complexity indicates broad potential reach, but the mandatory user interaction (UI:R) and unchanged scope (S:U) significantly constrain real-world risk - the attacker must lure a victim to a page rendering crafted media. Partial confidentiality and integrity impacts (C:L/I:L) suggest cross-origin data leakage or limited content injection rather than full compromise or code execution. EPSS data was not provided in the input. No CISA KEV listing and no public POC code are identified, meaning there is no confirmed active exploitation signal. This is a genuine medium-priority patching item for browser deployments: high breadth of potential targets (ubiquitous browser), but low per-incident impact ceiling and no current active exploitation evidence.

An attacker hosts a webpage embedding a crafted audio or video element whose media content is engineered to trigger the origin validation error in Firefox's playback component. When a target user browses to this page in an unpatched Firefox, the media element causes the browser to misattribute the origin of a cross-origin resource, allowing the attacker's script to read data from or inject content into a different origin the user is authenticated to. No public POC has been identified, but the low attack complexity (AC:L) indicates this would be mechanically straightforward to reproduce once the specific bypass condition is understood.