Mozilla Firefox EUVD-2026-88937

Requires the victim to render attacker-controlled web content in an unpatched Firefox (UI:R): the user must visit a malicious or compromised page, or load malicious content within a page, that exercises the vulnerable DOM Core/HTML code path to trigger the use-after-free. No authentication is required (PR:N) and no special non-default Firefox configuration is indicated - default browsing is sufficient. Limiting factors: mandatory user interaction (page must be loaded/rendered), the flaw is confined to affected pre-fix versions (Firefox before 157, ESR before 153.4/140.17/115.42), and reliable exploitation must contend with Firefox's process sandboxing and heap-hardening mitigations.

This is a genuine but conditionally-triggered browser memory-corruption flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 HIGH) accurately reflects a use-after-free reachable when a victim loads attacker-controlled web content; the UI:R requirement (user must visit/render a malicious page) is the primary limiter, keeping this short of a wormable server-side critical. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a vendor self-reported (Mozilla) fix, not evidence of in-the-wild abuse. Weighing signals: high CVSS + ubiquitous product (Firefox) raises theoretical priority, but the absence of EPSS/KEV/POC and the need for user interaction argue against emergency treatment. Practically this is a routine 'patch in the normal browser-update cycle' item. Note the 'Information Disclosure' tag understates impact - CWE-416 UAF here is memory corruption with C/I/A:H (RCE-class), not an information-only bug; treat it as memory corruption. Also note this is the SECOND UAF in the same 'DOM: Core & HTML' component in this MFSA batch (alongside CVE-2026-100774), suggesting clustered fuzzing/audit findings rather than a single isolated defect.

An attacker hosts or injects a crafted web page that manipulates DOM Core/HTML objects to trigger a use-after-free, then reclaims the freed memory to corrupt browser state. A victim running an unpatched Firefox merely needs to visit the page (UI:R), after which the attacker may achieve memory corruption leading toward code execution in the content process. No public PoC is currently identified, and exploitation of modern Firefox UAFs typically requires bypassing sandboxing and hardening mitigations.