Mozilla Firefox EUVD-2026-88949

Requires the victim to open attacker-controlled web content in Firefox before version 157 (UI:R) that exercises the WebAssembly engine, so the attacker must deliver a page containing malicious WASM and get the user to visit it. No authentication or special browser configuration is needed - WebAssembly is enabled by default - but exploitation is limited by the mandatory user interaction and by the fact that reliable code execution from a heap UAF typically also requires defeating content-process sandboxing and ASLR. Users on Firefox 157 or later are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a classic client-side browser memory-corruption bug: an unauthenticated remote attacker lures a victim to a crafted page (UI:R) that triggers a use-after-free in Firefox's WebAssembly engine, yielding full C/I/A impact - the RCE-class outcome typical of a heap UAF in a JIT/execution engine. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is currently theoretical rather than observed. This was self-reported by Mozilla (routine coordinated disclosure), which is why there is no active-exploitation signal. The 8.8 score is a genuine 'high but not yet urgent' profile: the ubiquity of Firefox raises exposure, but the required user interaction and the absence of any exploitation or POC evidence keep real-world priority at medium. WASM UAF bugs are historically exploitable and attractive for exploit-chain development, so patch promptly even though no in-the-wild activity is confirmed. No conflicting signals detected - the CVSS vector, description, and CWE-416 classification are mutually consistent.

An attacker hosts or compromises a web page containing malicious WebAssembly that manipulates object lifetimes to trigger a use-after-free in Firefox's JS:WebAssembly component, then entices a victim to visit it (phishing link, malvertising, or watering-hole). Successful grooming of the freed allocation yields memory corruption that can be leveraged toward code execution in the content process. No public exploit code has been identified at time of analysis.