Mozilla Firefox EUVD-2026-88804

Exploitation requires the victim to use Firefox (before 157) or Firefox ESR (before 153.4) and to load attacker-controlled JavaScript - i.e., visit a malicious or compromised web page or render attacker content in a JIT-enabled context (UI:R in the CVSS vector). No authentication or special server-side configuration is needed (PR:N), and JIT compilation is on by default. Limiting factors: the user-interaction requirement (the victim must navigate to attacker content), the fact that impact is contained to a single system with no scope change (S:U, no confirmed sandbox escape in this CVE), and that reliable exploitation of a JIT UAF typically demands heap grooming and mitigation bypass - consistent with SSVC Automatable: no.

This is a genuine memory-corruption vulnerability but not an urgent, actively-exploited priority. Signals largely agree: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R) - the victim must load attacker-controlled JavaScript. CWE-416 (use-after-free) in the JIT compiler is classically exploitable toward arbitrary code execution, which is consistent with the SSVC Technical Impact of 'total.' Counterbalancing signals lower real-world urgency: SSVC Exploitation is 'none' and Automatable is 'no' (JIT UAFs typically require heap grooming and bypassing modern browser mitigations, not drive-by automation), there is no CISA KEV listing, no EPSS score was supplied, and no public POC is referenced. Net: treat as a routine-but-important browser patch (memory corruption in ubiquitous software) rather than an emergency. Note a labeling conflict - the 'Information Disclosure' tag understates the issue; a UAF in the JIT is memory corruption with full C/I/A impact (RCE-class), not merely info disclosure.

An attacker hosts a malicious web page containing crafted JavaScript that triggers a use-after-free in Firefox's JIT compiler and lures a victim to visit it (via link, ad, or compromised site). Successful exploitation corrupts memory in the content process, potentially leading to arbitrary code execution within the browser sandbox. No public exploit code is identified at time of analysis, and SSVC rates exploitation as 'none' and not automatable, reflecting the heap-grooming and mitigation-bypass work such JIT bugs require.