Mozilla Firefox EUVD-2026-88957

Requires the victim to load attacker-controlled web content in Firefox before version 157 (UI:R - user interaction via visiting/rendering a crafted page). No authentication and no special privileges are needed (PR:N), and default configurations are affected - there is no feature-flag or non-default setting prerequisite noted. The primary limiting factors are the need for user interaction (the victim must visit a malicious or compromised page) and that patched builds (Firefox 157 and later) are not vulnerable; the memory-corruption nature (UAF) may also make reliable exploitation across mitigations non-trivial.

This is a genuinely high-severity issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects a use-after-free that produces a SANDBOX ESCAPE: the S:C scope change is what lifts this to 9.6, distinguishing it from the ~8.8 content-process-only siblings in the same MFSA2026-97 batch (e.g. CVE-2026-100768, CVE-2026-100776). Network vector, low complexity, and no privileges are required, tempered only by UI:R (the victim must load attacker content). Countervailing signals: there is NO EPSS score, NO CISA KEV listing, and NO public exploit code - this is a Mozilla self-reported/internally-found flaw with no evidence of exploitation. So exploitation status is 'no public exploit identified at time of analysis.' The 9.6 reflects worst-case technical impact (escaping the content sandbox to the host), not observed attacks. Net: prioritize patching because of ubiquity and sandbox-escape potential, but there is no active-exploitation urgency signal. The 'Information Disclosure' tag understates the impact - this is memory corruption enabling escape, not merely info leak.

An attacker hosts a crafted web page (or injects malicious content into a site the victim visits) that manipulates the Preferences:Backend component to trigger the use-after-free. When the victim's Firefox renders the page, the freed object is reused to corrupt content-process memory and pivot into a sandbox escape, gaining code execution at the host/browser privilege level. No public proof-of-concept or exploit code is currently available.