Mozilla Firefox EUVD-2026-98490

Exploitation requires the victim to use a vulnerable Firefox version (prior to Firefox 158 or ESR 153.5) and to load attacker-controlled or attacker-influenced web content that exercises the DOM Bindings (WebIDL) code path - the CVSS UI:R metric confirms mandatory user interaction (visiting a page), which is the primary limiting factor. No authentication is required (PR:N, unauthenticated), and no special non-default browser configuration is indicated, but the attacker cannot trigger the flaw without the user navigating to the malicious content, and Automatable=no means it cannot be driven at scale without per-victim interaction. Impact is bounded to low confidentiality and low integrity (no availability impact) per the vendor-rated vector.

This is a moderate-severity memory-safety flaw that is unlikely to be a top patching priority but should be remediated in routine browser update cycles. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity, unauthenticated issue that nonetheless REQUIRES user interaction (UI:R) - the victim must load attacker-influenced web content - and yields only low confidentiality and low integrity impact with no availability impact. CISA's SSVC framework reinforces the low-urgency read: Exploitation=none (no observed exploitation), Automatable=no (requires per-victim user interaction, cannot be mass-automated), and Technical Impact=partial. No CISA KEV listing and no public POC are present in the provided data, so there is no public exploit identified at time of analysis. The signals are consistent rather than conflicting: a real but non-urgent use-after-free, typical of browser memory-safety fixes shipped in a scheduled release. The main caveat is that use-after-free bugs (CWE-416) can sometimes be escalated beyond the vendor-rated low impact if combined with other primitives, but nothing in the supplied data indicates that here.

An attacker hosts a malicious or compromised web page that drives the Firefox DOM WebIDL bindings into a use-after-free state when the victim visits it with a vulnerable browser version. Successful triggering could disclose small amounts of process memory or corrupt limited state (vendor-rated low confidentiality and integrity impact). No public exploit code is identified at time of analysis, and exploitation depends entirely on luring the user to attacker-controlled content.