Mozilla Firefox EUVD-2026-88939

Exploitation requires a victim to load attacker-controlled content that is processed by Firefox's XUL component (UI:R), so it is not a fully unattended remote attack; the user must navigate to or interact with a malicious page. No authentication is required (PR:N per CVSS vector), and it works against default Firefox configurations since XUL is a core internal component. The primary limiting factors are the mandatory user interaction and the fact that exploitation is rated non-automatable (SSVC Automatable: no), reducing feasibility of large-scale automated attacks. Affected: Firefox before 157 and Firefox ESR before 153.4.

Signals are notably mixed. The CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is critical, driven by a network vector, no required privileges, low complexity, a scope change (sandbox escape crossing a trust boundary), and total confidentiality/integrity/availability impact - consistent with SSVC 'Technical Impact: total'. However, exploitation-likelihood signals are low: EPSS is 0.15% (4th percentile), the vulnerability is NOT in CISA KEV, SSVC marks Exploitation as 'none' and Automatable as 'no', and no public exploit was identified. The 'Automatable: no' rating and the mandatory user interaction (UI:R - a victim must visit or interact with malicious content) materially temper the raw score: this is not a wormable, drive-by-at-scale issue. Net assessment: a genuinely severe memory-safety/sandbox-boundary flaw in a ubiquitous browser that warrants prompt patching, but current evidence points to no active or imminent mass exploitation rather than an in-the-wild emergency. The CVWE-20 classification (improper input validation) combined with a sandbox escape suggests exploitation would require a crafted content payload plus user navigation, aligning the low EPSS with the UI requirement.

An attacker hosts a malicious web page containing crafted content that abuses improper input validation in Firefox's XUL component. When a victim is lured into visiting the page (UI:R), the flaw is triggered to escape the browser content sandbox and execute code in the higher-privileged host context. No public exploit code was identified at the time of analysis, and exploitation is rated non-automatable.