Mozilla Firefox EUVD-2026-88803

Requires the victim to open or interact with attacker-controlled web content in a vulnerable Firefox build (UI:R) - versions prior to Firefox 157 or ESR 153.4. No authentication or pre-existing privileges are needed on the attacker side (PR:N), and no special victim configuration is indicated; default Firefox rendering of a crafted page is the trigger. The primary limiting factor is the required user interaction (the victim must be induced to visit the malicious page), and per SSVC the attack is not automatable, reducing suitability for worm-like mass exploitation. Patched Firefox 157 / ESR 153.4 installations are not exploitable.

This is a genuinely serious-severity browser flaw but not currently a top operational firefight. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects total technical impact via a CWE-269 privilege escalation in Firefox's Places (bookmarks/history) component, reachable by a remote unauthenticated attacker who lures a victim to a crafted page (UI:R). All exploitation signals, however, point AWAY from imminent mass exploitation: SSVC records Exploitation=none, Automatable=no, Technical Impact=total; there is no CISA KEV listing, no EPSS score supplied, and no public POC. So the picture is HIGH IMPACT but no evidence of exploitation - 'no public exploit identified at time of analysis.' The one signal worth flagging as ambiguous: CWE-269 privilege escalation combined with the vague 'Places component' description does not make clear whether the escalation is content-process-to-parent (a partial sandbox escape) or a lower-tier in-browser privilege gain; the S:U (scope unchanged) here - unlike the S:C sandbox-escape siblings CVE-2026-100800/100804 rated 9.6 - implies the escalation stays within a single security authority, which is consistent with the 8.8 rather than a scope-changing 9.6. Given Firefox's ubiquity, this warrants prompt patching, but the absence of automation and active exploitation makes it routine-urgent, not emergency.

An attacker hosts a malicious web page and drives a victim to it via phishing, malvertising, or a compromised site (UI:R). When the victim's Firefox renders attacker-controlled content that abuses the Places component's privilege management, the flaw grants elevated privileges leading to full compromise of the browser's security context (C:H/I:H/A:H). No public POC or active exploitation is known, and the attack is not automatable per SSVC.