Mozilla Firefox EUVD-2026-88801

Requires the victim to actively load or interact with attacker-controlled web content in Firefox (UI:R) - the flaw cannot be triggered against a passive or non-browsing user. Exploitation targets the Networking: HTTP component's handling, producing a spoofed/misrepresented UI (CWE-451). No authentication is needed on the attacker side (PR:N) and the attack is network-delivered (AV:N), but success depends on social-engineering the user into visiting the malicious page and acting on the spoofed content. Limiting factors: affects Firefox versions prior to ESR 153.4 / Firefox 157, requires user interaction, and yields only limited impact (no code execution, no integrity change per vendor scoring).

Signals are consistently LOW despite the ubiquity of the affected product. The CVSS 3.1 base score is 5.4 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - network-reachable and unauthenticated, but gated by required user interaction (UI:R) and limited to Low confidentiality and Low availability impact with no integrity impact. This is a CWE-451 UI-misrepresentation/spoofing weakness, not a code-execution or data-breach bug. All corroborating exploitation signals agree it is low priority: CISA SSVC decision framework rates Exploitation=none, Automatable=no, Technical Impact=partial, and there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis. The one tension in the data is categorical rather than severity-related: the issue is tagged 'Information Disclosure' and scored with C:L/A:L, yet CWE-451 and the 'Spoofing' description point to deception/integrity of displayed trust indicators rather than classic data disclosure or availability loss - treat the confidentiality/availability framing as the vendor's conservative mapping of user deception. Net: a genuine but low-real-risk browser hardening fix, not an urgent patch-now emergency.

An attacker hosts or injects a malicious web resource that abuses HTTP-layer handling to present spoofed or misleading content (e.g., a misrepresented origin/trust indicator) to a Firefox user. The victim must visit the attacker-controlled page or interact with crafted content (UI:R), after which they may be deceived into trusting attacker-supplied information or disclosing limited data. No public proof-of-concept or exploit code has been identified at time of analysis.