Mozilla Firefox EUVD-2026-98494

Exploitation requires the victim to load attacker-controlled web content in Firefox so that the vulnerable DOM: Core & HTML rendering path is exercised (CVSS UI:R). No authentication or prior privileges are needed (PR:N), and no special non-default browser configuration is indicated by the advisory. The key limiting factors are the mandatory user interaction (the attacker cannot reach the bug without the user rendering the content, which also makes it non-automatable per SSVC) and the need to run an unpatched version - Firefox before 158 or ESR before 153.5. Impact is bounded to partial confidentiality/integrity (C:L/I:L, no availability impact), consistent with limited memory disclosure rather than reliable code execution.

This is a moderate-severity memory-safety flaw with no indicators elevating it to active priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, score 5.4) describes a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction - i.e., the victim must visit or render attacker-controlled web content. All three CISA SSVC signals point away from urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be mass-scripted because it needs a user to load content), and Technical Impact=partial (consistent with the C:L/I:L/A:N partial-impact rating rather than full code execution). There is no CISA KEV listing and no POC referenced in the provided intelligence, so the status is no public exploit identified at time of analysis. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. The signals are internally consistent - a browser client-side UAF that is real but not a drop-everything issue. One caveat: use-after-free (CWE-416) bugs in a browser DOM engine can sometimes be chained toward code execution, yet Mozilla's own scoring and the SSVC partial-impact rating treat this as information disclosure / limited integrity impact rather than RCE; absent a vendor RCE claim, it should be treated per the stated moderate rating.

An attacker hosts a malicious web page (or injects malicious content into an ad/iframe on a site the victim trusts) that triggers the use-after-free in Firefox's DOM Core & HTML component when the page is rendered. A victim who browses to the page can have freed memory reused, potentially leaking a limited amount of in-process memory to the attacker. No public exploit code is identified in the available intelligence, and successful exploitation requires the user to load the crafted content.