Mozilla Firefox EUVD-2026-93377

Requires a vulnerable Firefox build prior to 157.0.1 and interaction with Firefox's File Handling component - i.e., the victim opening, downloading, or otherwise processing an attacker-supplied file, which realistically implies user interaction despite the input vector's UI:N. The flaw is a protection-mechanism/mitigation bypass (CWE-693), so its practical impact depends on chaining it with another attack whose mitigation it defeats, rather than standalone compromise. Limiting factors: the fix shipped in Firefox 157.0.1 (patched users are unaffected), exploitation is not automatable against a server (it is client-side and requires the user to handle malicious content), and Mozilla provides no public detail on the exact triggering file type or configuration.

The input CVSS 3.1 vector scores this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the supporting signals strongly contradict that severity. EPSS is only 0.14% (3rd percentile), CISA SSVC lists Exploitation as 'none', the CVE is NOT in KEV, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis'. SSVC does rate Automatable=yes and Technical Impact=total, which pairs with the high CVSS, but the near-zero EPSS and absence of any exploitation evidence suggest this is a high-CVSS-but-currently-low-real-risk issue rather than an active priority. Two signals conflict with the vector and should be verified with Mozilla: (1) the vector asserts UI:N, yet a 'File Handling' bypass in a browser almost always requires the victim to open or download a file (i.e., UI:R) - verify with vendor. (2) The CWE is CWE-693 (Protection Mechanism Failure / mitigation bypass), which typically weakens a defense to enable a separate attack rather than directly yielding full C/I/A compromise, so the H/H/H impact triad looks inflated for a standalone mitigation bypass. The one-line description provides no mechanism detail, limiting confidence. Net: patch on normal browser-update cadence; it is not an emergency based on current exploitation telemetry.

An attacker crafts a malicious file or web page that defeats a security mitigation in Firefox's file-handling code, and lures a victim running a pre-157.0.1 build to open or download it. Because the mitigation is bypassed, a protection that would normally block a follow-on attack is neutralized. No public exploit code or active exploitation has been identified for this issue.