Mozilla Firefox EUVD-2026-88956

Exploitation requires the victim to use an affected Firefox build (prior to Firefox 157, ESR 153.4, ESR 140.17, or ESR 115.42) and to visit or interact with attacker-controlled web content that exercises the WebExtensions component - this is the user-interaction (UI:R) prerequisite. No authentication or prior privileges are needed on the attacker side (PR:N), and default configurations are affected since the flaw is in a core browser component. Limiting factors: the mandatory user-interaction step prevents fully silent mass exploitation, SSVC rates the issue non-automatable, and only unpatched versions are vulnerable, so timely browser updates fully remediate the risk.

Signals diverge sharply here. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N, base 8.1 HIGH) and SSVC 'Technical Impact: total' describe a serious same-origin policy bypass that a remote, unauthenticated attacker can trigger at low complexity against a browser - but only if the victim takes an action (UI:R), i.e. visits attacker-controlled content. Against that, the exploitation-likelihood signals are uniformly cold: EPSS is 0.17% (5th percentile), SSVC marks Exploitation 'none' and Automatable 'no', the CVE is NOT on CISA KEV, and no public exploit was provided. The net picture is a genuinely impactful confidentiality/integrity flaw whose REAL-WORLD urgency is moderate: high theoretical impact and ubiquitous attack surface (Firefox), but no evidence of exploitation and a required user-interaction step that limits drive-by scale. This should be patched promptly as part of routine browser update hygiene rather than treated as an emergency; the 'total' technical impact warrants prioritizing over typical HIGH-CVSS web bugs, but the absence of KEV/POC and low EPSS argues against crisis response. Note also a tag inconsistency: input labels this 'Authentication Bypass,' but CWE-346 and the description describe an origin-validation / same-origin-policy bypass, which is a distinct weakness class - verify tagging before automated routing.

An attacker hosts a malicious or compromised web page and lures a Firefox user into visiting it (UI:R). The page abuses the WebExtensions origin-validation flaw to bypass the same-origin policy, allowing attacker-controlled script to read and tamper with data belonging to other origins (e.g. a logged-in webmail or banking session). No public exploit was provided, and SSVC rates the issue non-automatable, so weaponization would require targeted effort.