Mozilla Firefox EUVD-2026-98510

Exploitation requires the WebAssembly feature of Firefox's JavaScript engine to process attacker-supplied WASM/JS content - i.e., the victim must open or render a malicious web page or document in an unpatched Firefox prior to version 158 (UI:R in the vector). No authentication is needed (PR:N) and the attack is network-delivered (AV:N) against default configurations, since WebAssembly is enabled by default. The principal LIMITING factor is the mandatory user interaction (visiting/loading attacker content); there is no privilege requirement and no special non-default configuration is needed. Impact is bounded - low confidentiality and integrity effect, no availability impact - consistent with a constrained memory-disclosure/corruption primitive rather than full system compromise.

This is a medium-severity (CVSS 5.4) use-after-free (CWE-416) in Firefox's JavaScript WebAssembly component. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (victim must load attacker-controlled content) with only low confidentiality and integrity impact and no availability impact. The multiple signals are mutually consistent and all point AWAY from urgent priority: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial, which aligns with the low CVSS impact metrics and the requirement for user interaction. There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation probability could not be quantified; no public exploit code was referenced. The 'Memory Corruption' tag might suggest code-execution potential typical of UAF bugs, but the vendor-assigned impact (C:L/I:L/A:N, tagged 'Information Disclosure') and SSVC 'partial' technical impact suggest this was assessed as a limited info-leak/memory-disclosure primitive rather than reliable remote code execution. Net assessment: a real but non-urgent browser memory-safety bug - patch via normal update cadence rather than emergency response. NOTE: EPSS data is absent from the input, so widespread-exploitation likelihood cannot be confirmed either way.

An attacker hosts a malicious web page containing crafted JavaScript/WebAssembly that triggers the use-after-free in Firefox's WASM engine; when a victim using an unpatched Firefox (before 158) visits the page, the freed-then-reused memory is leveraged to disclose sensitive in-process memory contents and/or corrupt limited integrity-relevant state. No authentication is required, but the victim must actively load the attacker's content (UI:R). No public proof-of-concept exploit was identified in the provided intelligence.