Mozilla Firefox EUVD-2026-88799

Exploitation requires the victim to load and interact with attacker-controlled web content in Firefox (UI:R) that exercises the Address Bar component; no authentication or elevated privileges are needed (PR:N). Limiting factors: the mandatory user interaction rules out unattended/automatable exploitation (SSVC Automatable: no), and the flaw is remediated in Firefox 157, ESR 153.4, and ESR 140.17, so only unpatched installations before those builds are exposed. No non-default configuration is called out in the advisory; the flaw appears reachable in default browsing.

This is a genuine but not top-tier priority. The CVSS 8.8 (High) rests on a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N) with total technical impact (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating and the CWE-269 privilege-escalation classification - a successful exploit escapes the intended web-content privilege boundary. However, several signals temper urgency and point AGAINST widespread mass exploitation: exploitation requires user interaction (UI:R - the victim must visit or interact with attacker content), and every exploitation signal that would indicate active threat is negative. SSVC reports Exploitation: none and Automatable: no; there is no EPSS score, no CISA KEV listing, and no public POC in the provided data. Mozilla is the sole reporter (self-disclosed, patch-accompanied), which typically means responsible disclosure rather than in-the-wild discovery. The CVSS vector and description are internally consistent (network-delivered browser flaw, user must load content), so no metric conflict needs vendor verification. Net: treat as a standard 'patch in the next cycle' High-severity browser bug - real impact if exploited, but no evidence of active or automatable exploitation as of analysis.

An attacker crafts a malicious web page (or malicious content injected into a page) that abuses the Address Bar component; when a victim visits the page and interacts with it, the flaw escalates the attacker's web-content privileges beyond the intended sandbox/UI boundary. No public exploit code is available, and the attack requires the victim to take an action (UI:R), making it suitable for phishing/drive-by lures rather than unattended mass compromise.