Mozilla Firefox EUVD-2026-60665

Exploitation requires the victim to load attacker-controlled web content in an unpatched version of Firefox - this is achievable via a drive-by visit to a malicious or compromised website, a phishing link, or a malicious advertisement on a legitimate site. The CVSS vector (PR:N/UI:R/AV:N/AC:L) confirms no authentication is required on the attacker's side and no special browser configuration is needed - the vulnerability exists in default Firefox installations. The limiting factor is user interaction: the victim must actively navigate to or render the malicious content (UI:R), ruling out fully passive or server-side exploitation. Additionally, the scope is unchanged (S:U), suggesting browser sandbox boundaries may constrain post-exploitation impact to the renderer process absent a sandbox escape chain. Exploitation is not restricted to a specific operating system platform given the cross-platform CPE scope.

The CVSS 3.1 base score of 8.8 (High) reflects a network-exploitable, low-complexity, unauthenticated vector requiring only user interaction - consistent with a drive-by browser exploit. CVSS metrics C:H/I:H/A:H indicate full triad compromise of the browser process is plausible upon successful exploitation. No EPSS data was provided in the input, so exploitation probability cannot be quantified. KEV status is absent, meaning CISA has not confirmed active in-the-wild exploitation as of this analysis. No public POC has been identified. The CWE mismatch (CWE-359 assigned vs. CWE-416 implied by description) introduces minor uncertainty about the precise impact vector - if the flaw is primarily an information disclosure without arbitrary code execution, C:H would be appropriate but I:H/A:H may overstate impact. Cross-referencing the 'Information Disclosure' tag with CWE-359 suggests the possibility that this UAF primarily leaks sensitive memory rather than enabling full RCE, though UAFs in layout engines routinely cross that threshold. The breadth of patching across three ESR branches simultaneously (mfsa2026-74 through mfsa2026-80) is consistent with a significant security release, reinforcing prioritized patching.

An attacker hosts a web page embedding a specially crafted HTML document with malformed text or font resources designed to trigger a use-after-free condition in Firefox's layout engine during document reflow. A victim user visits the page - via a phishing link, malicious advertisement, or compromised website - and the browser processes the crafted content, freeing a layout object while a dangling pointer remains live. The attacker leverages heap manipulation to redirect execution and achieve arbitrary code execution within the Firefox renderer process. No public POC has been identified at time of analysis.