Mozilla Firefox EUVD-2026-88796

Exploitation requires the victim to run an unpatched Firefox prior to version 157 and to load attacker-controlled web content that exercises the WebAssembly engine (UI:R in the vector). No authentication or elevated privileges are needed (PR:N), and WebAssembly is enabled by default, so no special browser configuration is required. The practical limiting factors are the mandatory user interaction (visiting or rendering the malicious page), the scope-unchanged nature of the bug (S:U - it does not by itself escape the content-process sandbox), and the modest confidentiality/integrity impact (C:L/I:L, no availability impact); a full host compromise would require chaining with a separate sandbox-escape bug.

All exploitation-probability signals point to low real-world urgency despite the MEDIUM 5.4 base score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must load a crafted page - and yields only low confidentiality and low integrity impact with no availability effect, consistent with a content-process issue that does not escape the sandbox on its own. EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified, so this is not actively exploited and not a near-term mass-exploitation candidate. No SSVC decision data was provided in the input. There is no contradiction among the signals: the modest vendor score, trivially low EPSS, absence of KEV/POC, and the UI:R gating all agree this is a routine browser memory/logic hardening fix bundled into Firefox 157, not a standalone priority. The main caveat is specificity: CWE is N/A and the description is a bare 'Other issue in the JavaScript: WebAssembly component,' so the precise bug class cannot be confirmed from available data.

An attacker hosts a malicious web page containing crafted WebAssembly/JavaScript that triggers the flaw in Firefox's WebAssembly engine, and lures a victim running an unpatched Firefox (pre-157) to visit it. On load, the bug lets the page disclose a small amount of in-process information and/or cause limited integrity effects within the content process. No public exploit code was identified at time of analysis, and successful attack requires the victim to actually open the attacker-controlled content.