Mozilla Firefox EUVD-2026-88795

Requires the victim to actively load attacker-controlled web content in an unpatched Firefox (before 157) or Firefox ESR (before 153.4); this user-interaction requirement (UI:R) is the primary limiting factor. The flaw lives in the DOM:Networking site-isolation path, so exploitation depends on the browser processing cross-origin network activity in the way the crafted page induces - no authentication and no special victim configuration is needed beyond running a vulnerable version with default settings. There is no server-side or zero-click remote trigger; the attacker cannot exploit a Firefox instance that never visits malicious content.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 8.1 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction - the victim must load attacker-controlled web content for Firefox's rendering engine to process. This is the realistic model for all browser-engine bugs and tempers the 8.1 score: there is no server-side or direct remote trigger. Exploitation signals point to LOW real-world urgency: EPSS is 0.15% (4th percentile), there is NO CISA KEV listing, and no public exploit code is identified. A CWE-346 (origin validation error) site-isolation defect in the DOM:Networking component is a cross-origin confidentiality/integrity concern rather than a memory-corruption RCE, and the C:H/I:H/A:N profile reflects cross-origin data exposure and potential cross-origin request/response tampering rather than code execution. The I:H in particular is on the generous side for a pure site-isolation leak and is vendor-assigned (reported by Mozilla); verify against MFSA detail. Net: a legitimate security fix worth patching in routine browser-update cadence, not an emergency - no evidence of active or imminent widespread exploitation.

An attacker hosts a malicious web page (or injects a malicious iframe/ad into a page the victim visits) that abuses the site-isolation / origin-validation weakness in Firefox's DOM networking layer. When the victim browses to the page, the flaw lets attacker-controlled content observe or influence data that should be isolated to another origin, enabling cross-origin disclosure of sensitive responses. No public proof-of-concept or exploit code has been identified.