Mozilla Firefox EUVD-2026-88808

Requires an unpatched Firefox (before 157) or Firefox ESR (before 153.4) and the victim must load attacker-controlled web content that triggers the DOM Navigation component mitigation bypass (UI:R). No authentication is required of the attacker (PR:N), and no special victim configuration is needed since DOM navigation is core browser functionality, but exploitation is limited by the need for user interaction (visiting/loading the malicious page) and by the absence of any public exploit. The bypass defeats origin-separation mitigation, so realistic impact depends on the victim being simultaneously authenticated to a targeted cross-origin site.

Signals point to a genuine but non-emergency browser vulnerability rather than a top-priority crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw whose only real gate is user interaction (UI:R) - a victim must load attacker-controlled web content, which is normal browsing behavior. SSVC reinforces this nuance: Exploitation=none (no observed exploitation), Automatable=no (requires luring a victim to a page, not mass-scannable), Technical Impact=total. EPSS is very low at 0.15% (4th percentile), there is no CISA KEV listing and no public exploit identified, so this is not under active exploitation. The confidentiality/integrity 'total' rating stems from the same-origin mitigation being bypassed (CWE-346), letting a malicious origin read and manipulate content belonging to another origin - serious for data theft/account compromise but A:N (no availability impact). Net: a high-severity, Mozilla-reported, already-patched defense-in-depth/mitigation bypass with low near-term exploitation probability - patch on a normal cadence, not a fire drill. No signals conflict; EPSS low + SSVC none is consistent with a freshly disclosed, vendor-reported browser bug with no weaponization yet.

An attacker stands up a malicious or compromised web page that abuses the DOM Navigation mitigation bypass to defeat Firefox's origin-separation protections. When a victim running an unpatched Firefox (pre-157) or ESR (pre-153.4) browses to that page, attacker script can read or manipulate content tied to another origin (e.g., a site the user is logged into), enabling data theft or action-on-behalf. No public exploit code is identified at time of analysis, and exploitation requires the victim to visit the crafted content (UI:R).