Mozilla Firefox EUVD-2026-88943

Exploitation requires the victim to use an unpatched Firefox (before 157, ESR 153.4, ESR 140.17, or ESR 115.42) and to load attacker-controlled web content - the UI:R user-interaction requirement is the primary limiting factor. No authentication or special configuration is needed (PR:N against default browser settings), and no non-default features must be enabled; the DOM Core/HTML engine is always active. Realistic risk is bounded by the need to drive a target to a malicious/compromised page and by Firefox's content-process sandbox, which constrains what a single content-process compromise achieves without a sandbox-escape chain.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects a network-reachable, unauthenticated, low-complexity memory-corruption bug in a use-after-free (CWE-416) within Firefox's DOM: Core & HTML engine - the class of flaw that historically leads to sandbox-constrained remote code execution. The single dampening factor in the vector is UI:R: a victim must actively load attacker-controlled web content, so this is a client-side drive-by rather than a server-side wormable flaw. No EPSS score, CISA KEV entry, or public POC was provided in the intelligence, so there is NO evidence of active exploitation or available exploit code at time of analysis - the 8.8 is a capability rating, not an exploitation-in-the-wild signal. This was self-reported by Mozilla through its coordinated MFSA advisory process (typical of internally/researcher-found browser bugs fixed pre-disclosure), which correlates with low immediate weaponization. Signals are internally consistent - the CVSS vector matches the description (network delivery via crafted page, user interaction to visit it). Note the 'Information Disclosure' tag understates impact: a UAF here is memory corruption with C/I/A:H, i.e. RCE-class, not merely info leak. Net: patch on normal browser-update cadence; elevate if a POC or KEV listing appears.

An attacker crafts a malicious web page that manipulates DOM Core/HTML objects to trigger a use-after-free, then lures a victim into visiting it (phishing link, malvertising, or compromised site). When the freed object is reused, the attacker gains control over memory to corrupt the heap and attempt code execution within the content process. No public exploit code was identified at time of analysis, and successful exploitation requires the victim to load the attacker's page (UI:R).