Mozilla Firefox EUVD-2026-98483

Exploitation requires the victim to load attacker-controlled web content in Firefox (CVSS UI:R) that triggers a use-after-free in the Networking component; no authentication or pre-existing privileges are needed (PR:N). The limiting factor is the mandatory user interaction - a user must visit or be redirected to the malicious page - so there is no fully autonomous or server-side trigger, which is consistent with SSVC Automatable: no. Affected: Firefox before 158 and Firefox ESR before 153.5; successful exploitation yields a sandbox escape and site-isolation bypass, breaking a key browser security boundary. No special non-default configuration is indicated, meaning default Firefox installations below the fixed versions are exposed when rendering malicious content.

This is a genuinely high-priority vulnerability, though not one with confirmed active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting malicious web content), with a scope change reflecting the sandbox escape and full confidentiality, integrity and availability impact. CWE-416 (use-after-free) in the Networking component combined with the described sandbox escape / site-isolation break is the classic memory-corruption-to-privilege-boundary-crossing pattern browser attackers weaponize. However, the signals are consistent in pointing to potential rather than realized risk: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (memory-corruption browser bugs typically require a crafted exploit per target and are not mass-automatable), while Technical Impact is 'total,' aligning with the S:C/C:H/I:H/A:H rating. There is no CISA KEV listing and no POC referenced in the input, and no EPSS score was provided, so I cannot quantify exploitation probability. The UI:R requirement (victim must visit attacker-controlled content) is the main real-world brake on mass exploitation. Net assessment: treat as urgent-patch for any Firefox fleet due to the browser's ubiquity and total technical impact, but current evidence indicates no in-the-wild exploitation.

An attacker lures a victim to a malicious or compromised web page that serves crafted network/HTTP content triggering the use-after-free in Firefox's Networking component. The freed-then-reused memory is manipulated to corrupt browser state, allowing the attacker to escape the content sandbox and cross the site-isolation boundary, gaining code execution or cross-origin data access in the privileged browser context. No public exploit identified at time of analysis; user interaction (visiting the page) is required.