EUVD-2026-98505
GHSA-hxfr-4x3m-fvx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitTrigger flaw in Panning and Zooming component
-
ExecutionEscalate privileges beyond content context
-
ImpactExecute actions with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific affected feature is Firefox's Panning and Zooming component (the asynchronous pan/zoom rendering subsystem), reachable by any Firefox or Firefox ESR instance that renders attacker-controlled web content. Required versions: Firefox prior to 158 or Firefox ESR prior to 153.5. Limiting factors: the one-line description gives no explicit configuration or feature-enable precondition, and although the input CVSS marks UI:N, browser rendering-component flaws realistically require the victim to load a malicious page (effective user interaction), which meaningfully constrains mass exploitation; authentication requirements are not confirmed from available data, as the PR:L metric is not corroborated by the description. |
| Impact | Signals conflict and should be reconciled before prioritization. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U, 8.8) describes a network-reachable, low-privilege, no-interaction path with full CIA impact, which rates High. However, EPSS is very low at 0.19% (8th percentile), there is NO CISA KEV listing and NO public exploit identified at time of analysis, so the practical exploitation pressure today is modest despite the high base score. There is also a plausibility gap in the input metrics: this is a browser 'Panning and Zooming' (async pan/zoom/APZ) privilege-escalation flaw, and such Firefox bugs are normally triggered by rendering attacker-controlled web content, which typically implies UI:R (user visits a page) and PR:N (no account needed) rather than the PR:L/UI:N shown - verify the attack model with Mozilla. Net: treat as a standard browser-patch priority (patch in routine fast cadence) rather than an emergency; the high CVSS reflects worst-case impact, while EPSS/KEV/POC all indicate low real-world exploitation at present. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that exercises a flaw in Firefox's Panning and Zooming component; when a victim running an unpatched Firefox (pre-158) or Firefox ESR (pre-153.5) loads the page, the bug is triggered to escalate privileges beyond the normal content context, enabling high-impact compromise of confidentiality, integrity and availability. No public exploit code has been identified at time of analysis, so this is a theoretical scenario grounded in the CVSS impact metrics rather than an observed campaign. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege escalation in Mozilla Firefox's Panning and Zooming component lets an attacker who gets a target to render crafted content cross a privilege boundary inside the browser, with high impact to confidentiality, integrity and availability (CVSS 8.8). Affected builds are Firefox before 158 and Firefox ESR before 153.5, which Mozilla fixed via advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile), but the input vector and our independent assessment disagree on the exploit preconditions (PR:L/UI:N versus PR:N/UI:R), so reconcile those signals before prioritization; authentication requirements are not confirmed from available data.
RemediationAI
Vendor-released patch: Firefox 158 and Firefox ESR 153.5. Upgrade every affected installation to Firefox 158 or later, or to Firefox ESR 153.5 or later for managed and long-lifecycle deployments, and confirm the running build version after the update; details are in the Mozilla advisories at https://www.mozilla.org/security/advisories/mfsa2026-106/, https://www.mozilla.org/security/advisories/mfsa2026-108/, https://www.mozilla.org/security/advisories/mfsa2026-109/ and https://www.mozilla.org/security/advisories/mfsa2026-110/. No vendor-documented workaround appears in the supplied references, so compensating controls are limited: because the attack path requires the browser to render attacker-controlled web content, constrain browsing to trusted sites, push enterprise policy to block untrusted or unclassified content, and run high-value browsing sessions in a sandboxed VM or separate low-privilege profile to reduce the value of a browser-internal privilege escalation - accepting reduced usability and no removal of the underlying flaw. Disabling JavaScript or hardware-accelerated panning is not confirmed to close this vector and would degrade browsing significantly, so treat patching as the only reliable fix; given the low EPSS score and no public exploit code identified, this can be scheduled in a normal patch cycle, but the 8.8 severity warrants prompt action on internet-facing or high-value endpoints.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in Firefox's panning and zooming subsystem, the asynchronous pan/zoom rendering path that lets the browser scroll and zoom web content independently of the main script thread. CWE-269 (Improper Privilege Management) describes the root-cause class: a privilege or role check on an operation in that component was missing or applied incorrectly, so an operation can complete with higher privileges than the caller should hold. Mozilla tracks the underlying work in Bugzilla bug 2059195 and shipped fixes in Firefox 158 and Firefox ESR 153.5, referenced by MFSA advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. The CPE data (cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*) uses an all-version wildcard, so it does not by itself bound the affected range - the advisory text is the authoritative source for the pre-158 / pre-153.5 ESR boundary. Both the supplied vector and our assessment keep scope unchanged (S:U), meaning the demonstrated impact stays within Firefox's own security context rather than implying an operating-system sandbox escape, and no configuration or feature-enable precondition is stated in the description.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Browser rendering-component flaw triggered by loading a malicious page, so AV:N, PR:N and UI:R; sparse data supports high CIA impact but no confirmed scope change, so S:U.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Executive ViewAI
A high-severity privilege-escalation flaw in Mozilla Firefox (CVE-2026-109743, CVSS 8.8) lets crafted web content cross a security boundary inside the browser, potentially exposing sensitive data and enabling unauthorized changes on affected endpoints. Because Firefox is broadly deployed across the workforce rather than confined to one business unit, the exposure is organization-wide, and a successful attack could hand an intruder the user's full privileges on that machine. No public exploit code has been identified and measured exploitation likelihood is low, so this is a scheduled high-severity remediation rather than a crisis, but the affected population and impact to confidentiality, integrity, and availability justify leadership attention and prompt patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB