EUVD-2026-98488
GHSA-mw96-gf64-c265
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web content
-
ExploitTrigger use-after-free in Crash Reporting component
-
ExecutionReuse freed memory in browser process
-
ImpactLimited memory disclosure or corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to load attacker-controlled web content that triggers the use-after-free in Firefox's Crash Reporting component (CVSS UI:R - user interaction is mandatory). No authentication is required (PR:N) and the attack is network-delivered (AV:N) against default Firefox installations, but the required user interaction and the non-automatable nature (SSVC Automatable=no) are the key limiting factors that reduce realistic risk. Only Firefox versions prior to 158 and ESR prior to 153.5 are affected; patched builds eliminate the condition. |
| Impact | This is a moderate-severity issue (CVSS 5.4) that signals align on treating as a non-urgent, patch-in-normal-cycle item rather than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated flaw, but one that REQUIRES user interaction (UI:R) - typically luring a victim to malicious web content - and yields only Low confidentiality and Low integrity impact with no availability impact. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed attempts), Automatable=no (cannot be reliably mass-exploited, consistent with UI:R), and Technical Impact=partial. There is no CISA KEV listing and no public exploit identified. Note a signal conflict worth highlighting: the input Tags include 'Denial Of Service' and 'Memory Corruption,' yet the authoritative CVSS vector sets A:N (no availability impact), which is unusual for a use-after-free that would typically cause a crash - this discrepancy should be verified against the Mozilla advisory, as a UAF in a Crash Reporting component could plausibly affect availability. Overall this is a genuine memory-safety bug but a low real-world priority given no exploitation, non-automatable nature, and mandatory user interaction. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page or content that triggers a use-after-free in Firefox's Crash Reporting component when a victim visits it. Successful exploitation could allow limited disclosure or modification of in-process memory (C:L/I:L), potentially as a step toward a broader memory-corruption chain. No public proof-of-concept or exploit code has been identified, and exploitation requires the victim to interact with attacker-controlled content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Use-after-free in Mozilla Firefox's Crash Reporting component lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled web content, producing the low confidentiality and integrity impact captured by the assessed CVSS 5.4 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Only Firefox builds before 158 and Firefox ESR builds before 153.5 are affected, and the flaw is fixed in those releases. There is no public exploit identified at time of analysis (SSVC exploitation: none; not automatable), and the mandatory user-interaction requirement keeps realistic risk moderate, making this a normal-patch-cycle item rather than an emergency.
RemediationAI
Vendor-released patch: upgrade to Mozilla Firefox 158 (release channel) or Firefox ESR 153.5 (ESR channel), the exact fixed versions named by Mozilla and the only confirmed remediation for this crash-reporting use-after-free. Patch details are in advisories mfsa2026-106 (https://www.mozilla.org/security/advisories/mfsa2026-106/) and mfsa2026-108 (https://www.mozilla.org/security/advisories/mfsa2026-108/), with the upstream bug at https://bugzilla.mozilla.org/show_bug.cgi?id=2068421; the CVE record itself is at https://nvd.nist.gov/vuln/detail/CVE-2026-109713. Mozilla's advisories describe no standalone workaround for the crash-reporting code path, so there is no configuration change that removes the vulnerability without upgrading; ad hoc attempts to disable the crash reporter would only reduce the observed trigger surface, not eliminate the underlying use-after-free, and would sacrifice crash telemetry that helps detect other defects. Because exploitation requires a victim to load attacker-influenced web content (UI:R) and SSVC rates the issue non-automatable, the pragmatic approach is to fold the Firefox and ESR updates into the normal patch cycle, prioritizing ESR fleets and users whose browsing routinely reaches untrusted or attacker-influenced content; conventional network blocking is not applicable here since the trigger travels through ordinary web browsing rather than a specific exposed service.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, in Firefox's Crash Reporting component, the subsystem that collects and relays crash/minidump information. In a use-after-free, a heap object is released while a stale reference to it remains reachable, so a later dereference of that poisoned pointer reads or writes memory that may already have been reallocated, yielding memory corruption rather than a clean fault. The assessed vector shows the trigger is delivered over the network (AV:N) at low complexity (AC:L) with no privileges required (PR:N), but the UI:R component means a victim must actually load or interact with the attacker-supplied content before the freed object is reused. Scope is unchanged (S:U) with only low confidentiality and integrity impact and, per the assessed vector, no availability impact, so the realistic worst case is limited memory disclosure or browser state corruption rather than full code execution or a targeted crash. Mozilla remediated the condition in Firefox 158 and Firefox ESR 153.5, documented in advisories mfsa2026-106 and mfsa2026-108, with the upstream report at Bugzilla bug 2068421.
Know when Mozilla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-reachable via malicious web content (AV:N) with no privileges (PR:N) but mandatory user interaction (UI:R); use-after-free yields limited memory read/write (C:L/I:L), with availability unrated per vendor though a UAF crash could warrant A:L.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Exploit-DB