EUVD-2026-88911
GHSA-p8r8-rmpf-jhgg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitTrigger Storage Quota Manager code path
-
ExecutionRead uninitialized heap memory
-
ImpactExfiltrate leaked contents to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content that exercises the Storage Quota Manager component in an unpatched Firefox (versions before 157, ESR 153.4, ESR 140.17, or ESR 115.42); no authentication or special browser configuration is indicated. The required user interaction (UI:R) - the victim must actively visit or render the malicious page - is the primary limiting factor, and the only realized impact is disclosure of uninitialized memory, with no code execution or availability effect established in the input. |
| Impact | Signals are consistent and point to a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - in a browser this means the victim must visit or render attacker-controlled web content. EPSS is very low (0.16%, 4th percentile) and CISA SSVC rates Exploitation as 'none' and Automatable as 'no', which agrees with the absence of KEV listing and absence of any referenced public POC. The lone elevated signal is SSVC Technical Impact 'total,' which aligns with the high confidentiality/integrity sub-scores but contrasts with the CWE-457 uninitialized-memory root cause and the 'Information Disclosure' tag, which normally implies confidentiality-dominant impact rather than integrity. In practice this is a high-CVSS browser memory bug with no evidence of real-world exploitation: patch in the normal cycle, prioritized by exposure of unpatched browsers rather than by imminent attack. Note the I:H rating in the input is not obviously supported by an uninitialized-memory read primitive and should be verified against Mozilla's advisory (mfsa2026-97 through -103). |
| Exploit ScenarioDerived | An attacker hosts a malicious or compromised web page that exercises the Storage Quota Manager code path, causing Firefox to read uninitialized heap memory and leak its contents (potentially cross-origin data or memory layout) back to attacker-controlled script. The victim must be lured into visiting the page (UI:R), and no authentication is required. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Uninitialized memory handling in Mozilla Firefox's Storage Quota Manager can leak contents of the browser's process memory to a remote attacker who persuades a victim to load attacker-controlled web content, affecting Firefox releases before 157 as well as ESR builds before 153.4, 140.17, and 115.42. The required user interaction (UI:R) is the main limiting factor, and no privileges are needed (PR:N); the independently assessed impact is confidentiality disclosure only, with no code execution or availability effect established, and triage should not treat the published I:H/A:N components of the 8.1 CVSS score as realized. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), with vendor-supplied fixes already available in Firefox 157 and the three ESR branches.
RemediationAI
Vendor-released patch: upgrade to Firefox 157 for the rapid-release channel, or to the matching ESR fix for whichever branch is deployed - Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 - as documented in the Mozilla security advisories (MFSA 2026-97 through 2026-103, with 2026-100 covering this CVE at https://www.mozilla.org/security/advisories/mfsa2026-100/ and the underlying report at https://bugzilla.mozilla.org/show_bug.cgi?id=2054736). Note that ESR 115.42 is the terminal update for the legacy 115 line, so environments still on 115.x should plan a migration to ESR 140.x or 153.x rather than relying on that branch long term; mixed-version fleets, managed endpoints with update pinning, and third-party builds that lag upstream are the most common sources of residual exposure. No specific about:config preference disables the Storage Quota Manager, since it underpins IndexedDB, Cache API, and localStorage - turning it off is not a viable workaround and would break most web applications. The practical compensating controls, all of which carry trade-offs, are to confine browsing to hardened or low-risk profiles, disable JavaScript by default in a script-blocking extension such as NoScript (breaks a large share of sites and is bypassable via extension-permitted domains), or use a separate browser/VM for untrusted or high-risk content (reduces productivity and can complicate session handling). Because SSVC records Exploitation: none and there is no public exploit code, no emergency change window is required, but the patch should be scheduled promptly given the High confidentiality rating of the assessed vector.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Storage: Quota Manager is Firefox's per-origin disk-space accounting subsystem (implemented around the dom/quota code that backs IndexedDB, the Cache API, localStorage, service-worker storage, and similar persistent storage consumers), and it brokers quota queries and storage writes between content processes and the parent process. The defect is CWE-457 (Use of Uninitialized Variable): memory returned, serialized, or exposed through a quota-manager code path is used before it is initialized, so whatever previously occupied that heap region may flow back to the requesting content. Because this is a memory-disclosure class bug rather than a memory-corruption one, the plausible outcome is leakage of process memory (potentially including data from other pages or internal browser state) and not control-flow hijacking. The published CVSS:3.1:AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N vector rates integrity impact as High, but the independent assessment scopes the issue to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - an unauthenticated network-reachable information disclosure gated by victim interaction, with no integrity or availability component. The CISA SSVC decision data records Exploitation: none and Automatable: no (consistent with the requirement for user interaction and the absence of exploit code), so this should be treated as a moderate-priority hardening fix rather than an emergency patch, notwithstanding the 'total' technical-impact label in the SSVC feed.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-delivered web content with user interaction and no auth (AV:N/AC:L/PR:N/UI:R); CWE-457 uninitialized-memory read is a disclosure primitive, so C:H but I:N/A:N.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
Mozilla Firefox’s Storage Quota Manager can leak browser process memory to attacker-controlled web content, affecting releases before 157 and ESR branches below 153.4, 140.17, and 115.42. The flaw is unauthenticated but requires user interaction, has no public exploit identified at time of analysis, and primarily risks confidentiality of data held in browser memory. Leadership should care because a successful leak could expose credentials, session tokens, or other sensitive information from employee browsers, though no code execution or service disruption has been established.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB