Mozilla Firefox EUVD-2026-60696

Exploitation requires the target to actively visit a malicious or compromised web page using a vulnerable Firefox version (prior to 154, or ESR prior to 153.1). The CVSS UI:R metric confirms that user interaction - specifically navigating to an attacker-controlled URL - is mandatory; drive-by exploitation without any user action is not possible. PR:N confirms no account or authentication on the target system is required. AC:H reflects that the race condition depends on precise timing and may require multiple attempts or specific system load conditions to trigger reliably. No special browser configuration, enabled feature flag, or non-default setting is identified as a prerequisite; any standard Firefox installation on a vulnerable version browsing to untrusted content is potentially in scope. Exploitation is bounded by the need for user interaction and the inherent probabilistic difficulty of winning the race.

The CVSS 6.8 Medium score reflects a genuinely constrained threat profile: AV:N confirms network reachability, but AC:H and UI:R substantially limit exploitation - the attacker must both win a precise race condition timing window and convince the user to visit a malicious page. EPSS at 0.15% (5th percentile) corroborates low observed exploitation probability, and this CVE is absent from the CISA KEV catalog with no reported POC code. C:H and I:H indicate that successful exploitation carries meaningful impact to browser memory confidentiality and integrity, but A:N confirms no availability consequence. No conflicts exist between the CVSS vector and the description; the high attack complexity accurately reflects the probabilistic nature of race-condition exploitation. This vulnerability represents a routine patch priority - not an emergency escalation - for most organizations given the high exploitation complexity and low empirical exploitation signal.

An attacker hosts a web page containing crafted JavaScript designed to trigger a race condition in Firefox's JavaScript Engine against a vulnerable version (pre-154 / pre-ESR 153.1). The target user is lured to the malicious page - via phishing link or compromised advertisement - and the script races against the engine's concurrent garbage collector or JIT compiler to access memory in a transient inconsistent state. If the timing race is won, the attacker achieves read or write access to browser memory, potentially exfiltrating sensitive data from the current session or corrupting JavaScript object state.