Mozilla Firefox EUVD-2026-60681

The Storage: Cache API is a standard browser feature enabled by default in Firefox - no non-default configuration is required. Exploitation requires that the victim navigate to an attacker-controlled web page while running Firefox prior to version 154 (or ESR prior to 153.1). The attack is limited to information inference through timing measurements; it does not grant write access or cause service disruption (I:N/A:N per CVSS). The scope of disclosed information is bounded to what is observable through cache timing - primarily which URLs or resources have been cached, not raw credential or session token content. Exploitation is further constrained by network timing noise and browser mitigations (e.g., timer resolution clamping introduced in prior Firefox releases), which increase attack complexity in practice beyond what AC:L in the official vector implies.

The official CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects high theoretical severity, but several signals moderate the real-world urgency: side-channel attacks against browser cache APIs (CWE-203) are technically non-trivial - they require precise timing measurements under controlled network conditions, suggesting AC:L may overstate ease of exploitation. The UI:N rating is also debatable, since exploitation requires the victim to load attacker-controlled content. No EPSS score was provided in the input, no CISA KEV listing exists, and no public proof-of-concept has been identified - these absences collectively indicate this is not being actively mass-exploited. The confidentiality impact is real but bounded: attackers gain inference about cached resources, not direct credential or session token access. The availability of patches in Firefox 154 and ESR 153.1 further reduces urgency for organizations with active patch cadence. That said, even a mid-sized IT operation should treat this as a standard patch-cycle priority given Firefox's near-ubiquitous browser deployment footprint and the lack of viable workarounds short of disabling the Cache API entirely.

An attacker hosts a malicious web page containing JavaScript that systematically queries the Storage: Cache API with timing measurements, probing whether resources from other origins have been cached in the victim's browser. By loading the page in an unpatched Firefox instance, the attacker's script observes timing discrepancies between cache hits and misses, enabling inference of which URLs the victim has recently accessed or which web applications are active in their session. No public exploit code has been identified at time of analysis, but the attack technique is well-documented in browser side-channel research literature.