Mozilla Firefox EUVD-2026-60674

The vulnerable code path is the Remote Settings Client component, and the 'sandbox escape' framing means the practical prerequisite is prior code execution within a Firefox content/sandbox process - typically obtained by getting the victim to load attacker-controlled web content, which in turn requires a running vulnerable Firefox (any version before 154). The published vector states UI:N and PR:N, but the escape-from-sandbox nature strongly implies user interaction (visiting malicious content) and a preceding content-process foothold in real deployments; this should be verified against the Mozilla advisory. Limiting factors that reduce realistic risk: exploitation almost certainly must be chained with a second bug to first enter the sandbox, Firefox's default auto-update rapidly shrinks the vulnerable population once 154 ships, and only pre-154 builds are exposed.

The signals are partially conflicting and should be weighed rather than taken at face value. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C, C:H/I:H/A:H, score 10.0) describes trivial remote unauthenticated exploitation with cross-scope impact, but a component described purely as a 'sandbox escape' almost always requires an attacker to already be executing code inside a content process - typically via a separate content-process bug - so in practice this is usually one link in an exploit chain rather than a standalone remote takeover; the UI:N/PR:N framing likely reflects Mozilla's convention of scoring the web-facing entry point rather than the escape in isolation. EPSS is not supplied, so exploitation probability cannot be quantified here, and the absence from CISA KEV plus no referenced proof-of-concept means there is no evidence of exploitation in the wild today. The tags label this 'Information Disclosure', which understates the C:H/I:H/A:H rating and the escape-to-parent nature - that discrepancy should be resolved against the Mozilla advisory. Given Firefox's large deployment footprint and the severity ceiling, any organization running Firefox should treat patching as urgent even though real-world exploitation would realistically require chaining; a mid-sized municipal IT team with limited staffing should still prioritize the update on its normal browser-patch cadence rather than deferring it.

An attacker lures a Firefox user to a malicious or compromised web page that first exploits a content-process bug to gain code execution inside the sandbox, then leverages this Remote Settings Client flaw to escape the sandbox into the privileged parent process, achieving control that spans the security boundary (scope change). No public proof-of-concept has been identified, and realistic exploitation depends on chaining with a separate content-process primitive.