Mozilla Firefox EUVD-2026-98489

Exploitation requires a victim using Mozilla Firefox prior to version 158 to load attacker-controlled web content that exercises the vulnerable Layout component code path - the UI:R metric confirms user interaction (visiting or rendering the malicious page) is mandatory. No authentication or special privileges are needed (PR:N), and default Firefox configurations are affected since the Layout engine is core rendering functionality. The principal limiting factors are the required user interaction and the inherently bounded impact (low confidentiality, low integrity, no availability), meaning an attacker cannot act fully remotely without enticing the user and cannot, per vendor scoring, achieve code execution or denial of service from this flaw alone.

Signals are consistent and point to a moderate, not urgent, priority. The vendor CVSS of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless REQUIRES user interaction (UI:R) and yields only low confidentiality and low integrity impact with no availability impact. EPSS reinforces low real-world risk at 0.15% (4th percentile), the flaw is NOT in CISA KEV, and no public exploit has been identified, so there is no evidence of active or imminent exploitation. No SSVC decision vector was supplied in the input, so automatable/technical-impact cannot be independently cross-referenced. The one tension worth noting: this is a CWE-119 memory-boundary defect (tagged Buffer Overflow) in a browser's Layout engine, a class that can sometimes be escalated, yet the vendor scored impact as only partial (C:L/I:L, A:N) rather than code execution - suggesting the boundary error leaks or corrupts limited memory rather than granting full control. Net: a routine browser memory-safety fix to be patched via normal update cadence, not an emergency.

An attacker hosts a malicious web page with crafted content that triggers the incorrect boundary condition in Firefox's Layout component, then lures a victim running a pre-158 Firefox to visit it. When the page renders, the out-of-bounds access leaks small amounts of adjacent memory or corrupts layout state, consistent with the low confidentiality/integrity impact. No public exploit code has been identified, and exploitation depends on the user actually loading the attacker's page (UI:R).