Mozilla Firefox EUVD-2026-88807

Requires an unpatched Firefox (before 157) or Firefox ESR (before 153.4), and the victim must actively load attacker-controlled web content that exercises the DOM:Security mitigation bypass (UI:R - drive-by via a malicious or compromised page). No authentication is required of the attacker (PR:N). The practical limiting factor is that this is a mitigation/defense-in-depth bypass (CWE-693): defeating the protection generally yields full impact only when combined with a separate content-process vulnerability, so it is a weakening primitive rather than a self-contained compromise. No special victim configuration is indicated beyond running a vulnerable version.

Signals conflict sharply. The vendor-assigned CVSS 3.1 is 9.6 (Critical) with AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, but every exposure signal points the other way: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, no public POC, and CISA SSVC records Exploitation: none and Automatable: no (only Technical Impact: total aligns with the high CVSS). The 9.6 is driven largely by the scope change (S:C) and full CIA impact, which for a browser 'mitigation bypass' (CWE-693) is optimistic - a protection-mechanism bypass defeats a defense-in-depth layer and typically must be CHAINED with a separate content-process memory-corruption bug to actually achieve C:H/I:H/A:H. On its own it weakens a mitigation rather than directly compromising data. Realistically this is an important-to-patch browser flaw but not an emergency: no active exploitation, requires victim interaction (UI:R, loading a crafted page), and the headline severity overstates standalone impact. Note: the PR:N/UI:R combination is consistent with a drive-by web-content bug.

An attacker hosts a malicious or compromised web page that exercises the crafted DOM content needed to bypass the DOM:Security mitigation; a victim running an unpatched Firefox/ESR visits it. The bypass neutralizes a browser defense-in-depth protection, which the attacker then pairs with a content-process exploit to read/alter data across the normal security boundary. No public exploit code is identified at time of analysis, and CISA SSVC lists exploitation as none.