Mozilla Firefox EUVD-2026-60670

The victim must use an unpatched version of Mozilla Firefox (any release prior to Firefox 154, ESR 140.14, or ESR 153.1) and must visit or be redirected to attacker-controlled web content that triggers the specific JIT miscompilation path. JavaScript must be enabled (the default for all Firefox configurations). No authentication, special privileges, or non-default configuration settings are required on the attacker's side. Exploitation is limited by the UI:R requirement - the victim must actively navigate to the malicious content; the browser does not autonomously execute the payload. The vulnerability produces information disclosure only (C:H, I:N, A:N), meaning an attacker cannot achieve code execution via this flaw alone based on available data.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 (Medium), reflecting a network-reachable flaw requiring only a single user interaction - visiting a malicious page - with no authentication prerequisite and high confidentiality impact. The scope is unchanged (S:U) and there is no integrity or availability impact, confirming this is a memory-read primitive rather than full remote code execution. No EPSS score was supplied in the intelligence data, so exploitation probability cannot be quantified numerically; however, the low attack complexity and no-privilege requirement make opportunistic exploitation plausible once a reliable trigger is developed. No KEV listing and no public POC are present, indicating exploitation has not yet been observed at scale. The UI:R gating is a meaningful limiter - passive drive-by exploitation requires the victim to navigate to attacker-controlled content, which browser security teams typically treat as a realistic threat model for browser engine bugs. With patches already released across three Firefox channels, the residual risk is concentrated in unpatched deployments, and organizations running Firefox ESR in managed environments should prioritize this update.

An attacker hosts a malicious webpage containing crafted JavaScript designed to trigger the JIT miscompilation path in SpiderMonkey. When a victim navigates to the page in an unpatched Firefox browser, the JIT compiler processes the crafted script, accesses memory using an incompatible type, and the attacker's script reads out-of-bounds heap memory - potentially capturing sensitive data such as credentials, cryptographic material, or session tokens held in the browser process. No public POC is known at time of analysis, but the low attack complexity (AC:L) in the CVSS vector suggests the trigger is not highly constrained.