Mozilla Firefox EUVD-2026-88790

Exploitation requires a victim using an affected Firefox build (versions prior to Firefox 157, ESR 153.4, or ESR 140.17) to load attacker-controlled web content that exercises the DOM: Core & HTML code path to trigger the use-after-free (UI:R - the user must visit/render the malicious page). No authentication is required (PR:N) and no non-default configuration is needed, but the reliance on user interaction and on a memory-corruption primitive that must be shaped into a working sandbox escape limits realistic exploitation; browser auto-update to a fixed version fully removes exposure.

This is a genuinely high-priority browser flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects a use-after-free in Firefox's DOM: Core & HTML component that results in a SANDBOX ESCAPE - the scope change (S:C) is what lifts this above the typical 8.8 seen in sibling Firefox UAFs and is consistent with escaping the content process to affect the host system. Exploitation is network-reachable and unauthenticated (PR:N) with low complexity (AC:L), but requires user interaction (UI:R), i.e. the victim must visit a crafted page - so it is not wormable/automatable in the drive-by-worm sense. Against these signals: there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data; SSVC exploitation status is effectively 'none.' The result is a memory-corruption bug with severe theoretical impact (sandbox escape on a browser deployed to hundreds of millions of users) but no evidence of active or automated exploitation at analysis time. Treat as a priority patch due to product ubiquity and sandbox-escape impact, while recognizing the practical bar (attacker must lure a victim to a malicious page). Note the Mozilla-self-reported provenance means fix data is authoritative but exploitation-in-the-wild is unproven.

An attacker hosts or injects (e.g. via malvertising) a crafted web page that manipulates DOM Core/HTML objects to trigger a use-after-free when a Firefox user visits it. Because the flaw enables a sandbox escape (S:C), successful memory-corruption exploitation could break out of the content process to compromise the host. No public exploit code is identified at time of analysis, and successful attack requires the victim to load the malicious page (UI:R).