Mozilla Firefox EUVD-2026-88806

Requires an unpatched Firefox (before 157) or Firefox ESR (before 153.4) and that the victim actively loads attacker-controlled web content (UI:R) which exercises the Bookmarks & History component to defeat a built-in security mitigation. The practical limiting factor is that this is a mitigation BYPASS (CWE-693): defeating the protection alone provides little direct damage and realistically must be chained with a separate content-process vulnerability to achieve the rated C:H/I:H/A:H impact. No authentication is required (PR:N) but user interaction is mandatory.

Signals point to a low-urgency, defense-in-depth fix rather than an active emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) was reported by Mozilla and reflects a worst-case chained outcome; however, CWE-693 (Protection Mechanism Failure) describes a MITIGATION BYPASS, which by nature weakens an existing security control rather than directly achieving full confidentiality/integrity/availability compromise on its own - so the C:H/I:H/A:H impact likely assumes chaining with a separate content-process bug and is arguably inflated for the standalone flaw. Corroborating lower-risk signals: EPSS is 0.15% (4th percentile), SSVC shows Exploitation=none and Automatable=no (though Technical Impact=total), and there is no CISA KEV listing and no public POC. The consistency of these signals suggests a high-CVSS-but-currently-low-real-risk issue: important to patch as part of routine browser updates, not a drop-everything emergency. UI:R is a genuine limiter - a victim must load attacker-controlled content.

An attacker lures a Firefox user to a malicious or compromised web page that exercises the Bookmarks & History component to bypass a built-in browser security mitigation, neutralizing a defense that would normally blunt a second memory-safety or content-process bug. On its own the bypass yields limited direct impact; chained with another content-process vulnerability it could contribute to broader compromise. No public exploit identified at time of analysis.