Mozilla Firefox EUVD-2026-98482

Exploitation targets the Firefox Application Update component and requires the attacker to already hold some level of local access to the affected host (PR:L in the provided vector), consistent with a privilege-escalation (CWE-269) flaw rather than a drive-by remote attack. The input vector lists UI:N (no user interaction) and AV:N, but the update-component nature strongly implies local presence is the real limiting factor. Exploitation is limited to unpatched versions prior to Firefox 158 and Firefox ESR 153.5; systems updated to those builds are not affected.

The input assigns a CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, implying a network-reachable, low-complexity flaw requiring only low privileges and yielding full confidentiality, integrity, and availability impact. However, this network vector conflicts with the description, which identifies the issue as privilege escalation (CWE-269) in the local Application Update component - a class of flaw that is typically locally exploited by an attacker who already has limited access to the host. VERIFY WITH VENDOR: CVSS indicates AV:N but a privilege-escalation flaw in an update mechanism normally implies local (AV:L) exploitation, so the published network vector may overstate remote reachability. Corroborating exploitation signals are weak: EPSS is only 0.19% (8th percentile), the CVE is not in CISA KEV, and no public exploit code is identified, so there is no public exploit identified at time of analysis. The combination of a high CVSS but low EPSS, no KEV listing, and no POC suggests this is a high-severity-by-impact issue rather than an actively exploited, widespread threat. It warrants prompt patching because Firefox is near-ubiquitous, but it is not an emergency drop-everything item absent evidence of exploitation.

An attacker with limited local access to a system running an unpatched Firefox or Firefox ESR build abuses a flaw in the Application Update component to escalate from a low-privileged context to elevated privileges, gaining full control over the browser's update-managed resources. No public exploit code is identified at time of analysis, and realistic exploitation likely requires the attacker to already be present on the host despite the input's network vector.