What is the CVSS score of EUVD-2026-88789?

EUVD-2026-88789 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate EUVD-2026-88789?

Within 24 hours, identify all endpoints running Mozilla Firefox DevTools prior to version 157 and, if Firefox 157 is available, deploy the vendor-released patch; if patch availability is unconfirmed per source conflict, restrict DevTools usage for untrusted content and warn users. Within 7 days, inventory Firefox versions, enforce managed updates to 157 or later where feasible, and apply browser policy controls to limit DevTools on high-risk systems. Within 30 days, verify remediation across all endpoints, conduct user awareness training on avoiding attacker-influenced content, and review monitoring for sensitive data exposure via browser developer tools.

Mozilla Firefox EUVD-2026-88789

| CVE-2026-100810 CRITICAL

Information Exposure (CWE-200)

2026-09-29 mozilla

GHSA-789r-f72w-5r5j

Information Disclosure Red Hat Mozilla Firefox

Critical

Disputed · 9.8 Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to crafted page
Exploit

Victim loads page in vulnerable Firefox
Execution

Trigger DevTools component flaw
Impact

Leak sensitive browser information to attacker

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an unpatched Firefox build prior to version 157 and victim interaction with the Firefox DevTools component (the browser's built-in developer tools), typically while inspecting attacker-influenced page content. Exploitation is limited to the client side: there is no server-facing network service, the victim must be using the browser and engaging DevTools, and the flaw is remediated by updating to Firefox 157. The single-sentence Mozilla advisory does not specify the exact trigger, so the precise content or DevTools action required is not detailed in available data.
Impact	The input CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is internally inconsistent with the assigned CWE-200 (Exposure of Sensitive Information) and the 'Information Disclosure' tag: an information-disclosure flaw should carry confidentiality-only impact (C:H/I:N/A:N), not full triad C:H/I:H/A:H. The UI:N and PR:N also appear inflated - this is a client-side flaw in the Firefox DevTools component, and browser-side bugs almost always require the victim to actively open DevTools and/or load attacker-influenced content, implying UI:R rather than UI:N. Supporting exploitation signals are weak: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code is referenced - all pointing to low real-world exploitation likelihood despite the headline 9.8. The description is a single generic sentence ('Other issue in the DevTools component'), which is typical of Mozilla's batched advisory entries and provides no technical detail to substantiate the network/no-interaction rating. Net assessment: this is a high-CVSS-but-low-real-risk issue - a routine browser maintenance fix best handled by normal auto-update cadence, not an emergency. CVSS vector says network/no-interaction but a DevTools bug realistically needs the victim to open developer tools - verify auth/interaction assumptions with Mozilla before treating the 9.8 as actionable.
Exploit ScenarioDerived	An attacker crafts a malicious or compromised web page containing content that, when inspected via Firefox's DevTools, leaks sensitive in-browser information to the attacker. The victim must be running an unpatched Firefox (pre-157) and interact with the page/DevTools for the flaw to trigger. No public proof-of-concept or active exploitation has been identified.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Information disclosure in Mozilla Firefox DevTools versions prior to 157 allows an unauthenticated remote attacker to potentially expose sensitive data when a victim interacts with the browser's developer tools while viewing attacker-influenced content. Exploitation requires user interaction (UI:R) and is client-side only; no public exploit code has been identified at time of analysis (EPSS 0.15%, percentile 4%). The vulnerability is fixed in Firefox 157.

RemediationAI

Upgrade to Mozilla Firefox 157 or later. This is the vendor-released patch; the fix is included in the standard browser update. No official workaround is documented. As a compensating control with functional trade-offs, users can avoid opening DevTools on untrusted or attacker-influenced pages, but this is not a substitute for patching. For details, see the Mozilla advisories at https://www.mozilla.org/security/advisories/mfsa2026-97/ and https://www.mozilla.org/security/advisories/mfsa2026-101/.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information) and resides within Firefox's built-in DevTools component. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a client-side information disclosure requiring user interaction, with high confidentiality impact but no integrity or availability impact. This contrasts with the initially provided CVSS 9.8 vector (C:H/I:H/A:H), which is inconsistent with an information-disclosure flaw. The exact trigger is not detailed in the available Mozilla advisory, but exploitation is limited to the browser client-there is no server-facing network service. The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms the affected product family, with patched versions starting at Firefox 157.

Know when Firefox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (mozilla) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.5 MEDIUM

CWE-200 info disclosure implies confidentiality-only (C:H, I:N, A:N); a client-side DevTools browser bug requires the victim to interact, so UI:R not UI:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat 6.1 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Oct 01, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Sep 29, 2026 - 12:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 12:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Other issue in the DevTools component. This vulnerability was fixed in Firefox 157.

Executive ViewAI

Why It Matters

Mozilla Firefox DevTools versions prior to 157 contain a critical information-disclosure vulnerability that can expose sensitive data when a user interacts with developer tools while viewing attacker-influenced content. The issue is client-side and requires user interaction, so the main organizational risk is targeted leakage from affected users rather than broad exploitation. Leadership should verify exposure and prioritize upgrading to Firefox 157 or applying interim DevTools restrictions if the patch is not immediately available.

Business Impact: High

Compensating Controls

Apply vendor patch (Firefox 157) if available; otherwise interim mitigations include disabling or restricting Firefox DevTools for untrusted content, limiting DevTools access on sensitive systems, isolating Firefox usage, and user awareness training.

Threat Intelligence Overview

EPSS Score

0.1%

Top 96% exploitable

Prevalence

High

Firefox is a major mainstream web browser with broad global deployment

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.