Mozilla Firefox EUVD-2026-88944

Requires the victim to be running an unpatched Firefox before 157 / ESR before 153.4 / ESR before 140.17 and to load attacker-controlled web content that delivers crafted WebAssembly exercising the vulnerable JIT path. The JavaScript and WebAssembly JIT are enabled by default, so no special configuration is needed on the victim side, but exploitation is gated by required user interaction (victim must visit/render the malicious page) and by the content-process sandbox - with S:U and the capped C:H/I:L/A:N impact, this alone yields in-process memory disclosure, not host takeover, which would require chaining a separate sandbox-escape bug.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N, 7.1 HIGH) describes a remotely reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction - the victim must load an attacker-controlled page serving crafted WebAssembly/JavaScript. CWE-843 (type confusion) arising from JIT miscompilation in the JavaScript:WebAssembly component is a classic strong memory-corruption primitive that historically yields reliable exploitation, yet Mozilla capped impact at C:H/I:L/A:N, implying read-oriented memory disclosure rather than confirmed clean RCE in the base scoring. The real-world-risk signals point DOWN, not up: EPSS is only 0.16% (4th percentile), there is NO CISA KEV listing and NO public exploit identified at time of analysis. So despite the high CVSS and a dangerous bug class, this is currently an important-but-not-emergency patch-management item rather than an actively exploited crisis. One caveat worth verifying: the single line of description does not itself state the type-confusion/UI-required nature - those are inferred from the CWE and from the fact that browser bugs require the victim to visit content - but Mozilla's own PR:N/UI:R vector is consistent with that reading, so no contradiction exists in the provided data.

An attacker stands up a malicious web page (or compromises/injects into an ad or third-party script) that serves crafted WebAssembly designed to trigger the JIT miscompilation. When a victim running an unpatched Firefox/ESR build visits the page, the type confusion corrupts memory in the content process, giving the attacker a read primitive to disclose sensitive in-process memory and potentially a foothold for further exploitation. No public exploit code has been identified at time of analysis, so weaponization would require independent development.