Mozilla Firefox EUVD-2026-88786

Requires the victim to visit or interact with an attacker-controlled or compromised web page in Firefox (UI:R) that exercises the DOM Service Workers code path - Service Workers are enabled by default over HTTPS, so no non-default configuration is needed. Exploitation is remote and unauthenticated (PR:N) with low complexity (AC:L), but the mandatory user-interaction requirement and the need for the victim to be running an unpatched Firefox (before 157 / ESR 153.4 / ESR 140.17) are the primary limiting factors. Scope is unchanged (S:U), meaning impact is confined to the browser's own privilege boundary rather than escaping to the host OS.

This is a genuinely notable but not top-tier-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose sole gating factor is user interaction (victim must visit/interact with a crafted page). The CWE-269 privilege-escalation classification within the DOM Service Workers component combined with C:H/I:H/A:H points to a content-process compromise where a Service Worker gains capabilities beyond its intended origin/privilege boundary. Crucially, exploitation signals are cool: CISA SSVC records Exploitation=none and Automatable=no, there is no EPSS score, no CISA KEV listing, and no public POC - this was a Mozilla self-reported/internally-discovered defect fixed proactively. Technical Impact=total in SSVC is consistent with the C/I/A:H impact metrics. So the high CVSS reflects worst-case technical impact, not observed exploitation; the realistic priority is MEDIUM: patch on a normal cadence given Firefox's ubiquity, but there is no evidence of in-the-wild targeting. Note S:U (scope unchanged) means this is characterized as privilege escalation within the browser's own privilege model rather than a full sandbox escape to the host (unlike some sibling bugs in the same batch scored 9.6 with S:C).

An attacker hosts a malicious web page (or injects malicious content into a page the victim visits) that abuses a flaw in Firefox's DOM Service Workers implementation. When the victim loads and interacts with the page, a Service Worker is manipulated to escalate its privileges within the browser, gaining high-impact confidentiality, integrity, and availability control over the affected process. No public proof-of-concept or evidence of active exploitation exists at time of analysis.