Mozilla Firefox EUVD-2026-88951

Exploitation requires the victim to load attacker-controlled web content in Firefox (UI:R), triggering the cryptography misuse in the Storage: Quota Manager component; no authentication or prior privileges are needed (PR:N). Limiting factors: the user must actively visit or interact with the malicious page, affected versions are Firefox before 157 and Firefox ESR before 153.4 (patched builds are not exploitable), and there is no evidence of automatable or active exploitation (SSVC Automatable=no, not in KEV). The exact storage data exposed and whether integrity can be affected are not detailed in the available description.

Signals here are mostly concordant toward a moderate, not urgent, priority. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is required user interaction - consistent with a browser bug triggered by visiting attacker-controlled content. However, the exploitation-side signals strongly temper this: EPSS is just 0.15% (4th percentile), it is NOT on CISA KEV, no public proof-of-concept is referenced, and CISA SSVC scores Exploitation=none and Automatable=no. The one aligned high-severity signal is SSVC Technical Impact=total, which matches the C:H/I:H claim. The apparent tension is between a high CVSS (8.1) and very low real-world exploitation likelihood - this is a high-severity-but-low-current-risk issue, typical of a browser cryptography-misuse bug (CWE-325) that is serious in theory but requires a crafted site and victim interaction, and shows no sign of active or automatable exploitation. Note a minor internal inconsistency: a 'Cryptography misuse' / 'Information Disclosure'-tagged flaw intuitively suggests a confidentiality impact (C:H), yet the supplied vector also asserts I:H; the integrity impact is not clearly explained by the terse description and should be verified against Mozilla's advisory.

An attacker lures a Firefox user to a malicious or compromised web page; because of the cryptography misuse in the Storage Quota Manager, sensitive stored data that should be protected is exposed to (or alterable by) the attacker's web content. No authentication is required, but the victim must visit the page (UI:R). No public exploit code is referenced at time of analysis.