Mozilla Firefox EUVD-2026-88958

Exploitation requires a victim using Firefox before version 157 to actively load attacker-controlled audio/video content (UI:R - visiting or interacting with a crafted page). No authentication is needed (PR:N), and the vector is network/web (AV:N), but the race-condition nature imposes high attack complexity (AC:H): the attacker must win a non-deterministic timing window between concurrent media-processing operations, so exploitation is not reliably repeatable. The primary limiting factors are the mandatory user interaction and the timing-dependent, non-automatable trigger (SSVC Automatable:no); no special non-default configuration is indicated. Fixed by upgrading to Firefox 157.

This is a memory-safety flaw (CWE-362 race condition leading to use-after-free) in Firefox's Audio/Video component. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.5) is notably lower than the 8.8 rating of its many sibling UAF CVEs in the same MFSA2026-97 batch - the difference is AC:H, reflecting that winning a race window is timing-sensitive and not reliably reproducible on demand. All exploitation signals point away from immediate priority: SSVC records Exploitation:none, Automatable:no (consistent with a race that cannot be trivially scripted at scale), though Technical Impact:total confirms full C/I/A compromise if the race is won. There is no EPSS score, no CISA KEV listing, and no public POC. Net: a genuine RCE-class memory-corruption bug in a ubiquitous browser, but its real-world exploitability is dampened by AC:H (race timing) and mandatory user interaction (UI:R). Treat it as standard patch-cycle priority (medium) rather than emergency. One data caveat: the Tags include 'Information Disclosure', which understates and mislabels the flaw - a UAF here is memory corruption with full C/I/A impact, not an info-leak-only issue.

An attacker hosts a malicious web page containing crafted audio/video content designed to trigger a race between concurrent media-handling threads in Firefox. A victim who visits the page (UI:R) may hit the narrow timing window that frees and then reuses a media object, corrupting memory in the content process; a successful exploit could achieve code execution. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) makes reliable triggering difficult.