Mozilla Firefox EUVD-2026-60685

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Firefox build (before 154, or ESR before 153.1) with the Web Audio API available, which is the default state. The attacker's JavaScript must exercise the Web Audio component and measure the side-channel discrepancy to recover information; no authentication and no special server-side configuration are needed. Limiting factors: the victim must visit or be redirected to the malicious page (user interaction in practice), side-channel measurement is inherently noise-sensitive and may need favorable conditions to extract meaningful data reliably, and users already on Firefox 154 / ESR 153.1 or with Web Audio disabled are not exploitable.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) rates this Critical, but the signals conflict and warrant scrutiny: the description and CWE-203 describe a pure side-channel information-disclosure issue, which is inconsistent with the I:H (high integrity impact) in the supplied vector - a side channel leaks data, it does not modify it, so I:H appears overstated and should be verified with the vendor. A browser side channel realistically requires the victim to load attacker-controlled web content, arguing for UI:R rather than the supplied UI:N, and side-channel extraction is typically non-trivial, arguing for higher attack complexity than AC:L. EPSS is very low (0.14%, 4th percentile), there is no CISA KEV listing and no public exploit, so despite the 9.1 headline there is no evidence of imminent mass exploitation. Net: a legitimate confidentiality-affecting browser bug worth patching in the normal cycle, but the Critical rating is driven by generous metric choices; real-world urgency is moderate absent any exploitation signal.

An attacker lures a victim to a malicious or compromised web page whose JavaScript uses the Web Audio API to perform precise measurements of audio-processing timing or state. By observing these discrepancies, the script infers data that should be isolated (for example cross-origin or otherwise confidential information), without any authentication or elevated privileges. No public proof-of-concept has been identified, and successful extraction requires the victim to load the attacker's content.