Mozilla Firefox EUVD-2026-88793

Exploitation requires a victim using an affected Firefox (before 157) or Firefox ESR (before 153.4) to load attacker-controlled web content that executes JavaScript through the JIT engine - JIT compilation is on by default, so no special configuration is needed on the victim side. The limiting factor is user interaction (UI:R): the victim must visit or be redirected to the malicious page. Because scope is unchanged (S:U), impact is initially confined to the browser content process; escaping to the host requires chaining a separate sandbox-escape vulnerability. No authentication is required (PR:N).

This is a genuine near-critical browser flaw in the SpiderMonkey JavaScript JIT engine - historically the highest-value Firefox attack surface for reliable RCE, since JIT boundary/type-confusion bugs give attackers precise control over memory. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows a network-reachable, low-complexity, unauthenticated bug requiring only that a victim visit a malicious page (UI:R). No EPSS score, KEV listing, or POC is provided in the input, and the report is a Mozilla self-disclosure, so all exploitation signals currently point to 'no confirmed exploitation.' The 8.8 reflects impact-and-reachability potential, not observed activity - this is a patch-promptly item rather than a drop-everything emergency. Note S:U (scope unchanged) means this alone does not escape the content sandbox; full host compromise would typically require chaining with a separate sandbox-escape bug (cf. the UAF sandbox-escape siblings CVE-2026-100800/100804 in the same batch). CWE-119 (generic memory corruption) with 'incorrect boundary conditions' plus the C/I/A:H triad is consistent with an out-of-bounds read/write in JIT-generated code.

An attacker hosts or injects (via malvertising/compromised site) a web page containing JavaScript crafted to trip the JIT compiler's incorrect boundary condition, producing an out-of-bounds access in JIT-generated code. When a victim running an unpatched Firefox/ESR simply loads the page (UI:R), the attacker corrupts memory in the content process to gain code execution within the browser sandbox. No public exploit code is identified at time of analysis; a sandbox escape would need to be chained for full host takeover.