Mozilla Firefox EUVD-2026-60683

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Firefox build (before 154, or ESR before 153.1) with Service Workers enabled, which is the default configuration. Per the CVSS vector there is no authentication (PR:N) and no user interaction beyond navigation (UI:N), and the attack is network-reachable (AV:N) with low complexity (AC:L). Limiting factors are that the user must actually visit the malicious page, the target origin's data is only exposed while the victim has an active/cached session with that origin, and impact is confined to confidentiality and integrity (A:N) within the browser rather than the host OS; patched or non-Firefox browsers are unaffected.

The signals are partly consistent and partly conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) argues for high priority - remotely reachable, low complexity, no privileges and no user interaction beyond visiting a page - and a same-origin bypass genuinely threatens confidentiality and integrity of any site a victim is logged into, so even a mid-sized municipal IT team in gdynia should treat browser fleet patching here as urgent rather than routine. Against that, there is no EPSS score supplied, no KEV listing and no evidence of a public POC, which tempers the immediacy: high CVSS reflects potential impact, not observed exploitation. Note also the metadata inconsistency - the free-text tags label this 'Authentication Bypass' and 'Memory Corruption', yet the description and CWE-843 point to a type-confusion-driven same-origin bypass, not classic memory corruption; treat the 'Memory Corruption' tag as unverified. Overall this is a real priority for any organization running Firefox at scale because the affected component is on by default, but the absence of exploitation telemetry suggests routine-urgent patching rather than emergency incident response.

An attacker hosts or compromises a web page and lures a Firefox user to visit it; when the page loads, malicious script exploits the Service Worker origin-check flaw to read responses or cached data scoped to another origin the victim is authenticated to, such as a webmail or SaaS session. No credentials, plugins, or user clicks beyond visiting the page are required. No public exploit code has been identified, so this remains a plausible rather than observed attack path.