Mozilla Firefox EUVD-2026-98516

Exploitation requires a victim using Firefox prior to version 158 to interact with attacker-controlled web content (UI:R) that exercises the DOM content-process code path - i.e., visiting a malicious or compromised page or rendering crafted web content. No authentication or special privileges are needed (PR:N, so unauthenticated), and it works remotely over the network (AV:N) against standard Firefox installations; there is no indication a non-default configuration is required. The primary limiting factor is the mandatory user interaction (loading the malicious content) and the fact that a sandbox escape typically must be paired with a separate content-process code-execution bug to be fully impactful, which constrains realistic standalone exploitation.

This is a high-severity sandbox escape (CVSS 9.6) in Firefox's DOM: Content Processes component with a network attack vector, low complexity, no privileges, and a scope change (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), consistent with CWE-693 (Protection Mechanism Failure) - the content-process sandbox fails to contain a malicious page, yielding full confidentiality, integrity, and availability impact beyond the sandbox boundary. However, the exploitation signals temper the raw score: EPSS is only 0.19% (8th percentile), there is NO CISA KEV listing, and no public exploit identified at time of analysis, indicating no observed real-world exploitation and no publicly available weaponization yet. The CVSS vector also requires user interaction (UI:R), meaning a victim must be induced to visit or interact with attacker-controlled content, which materially lowers the drive-by, mass-exploitation risk versus a zero-click flaw. Sandbox escapes are high-value and typically chained with a separate content-process RCE to achieve full compromise, so standalone exploitation may be harder than the score suggests; no SSVC decision data was provided in the input. Net: a genuine high-priority browser patch given the critical technical impact and ubiquity of Firefox, but current data points to it being a prepare-and-patch issue rather than an actively exploited emergency.

An attacker lures a Firefox user (via phishing link, malicious ad, or compromised site) to attacker-controlled web content that triggers the flaw in the DOM content-process handling. Because the content-process sandbox fails to contain the malicious code, the attacker breaks out of the sandbox to gain broader access to the host with the browser's privileges. No public exploit is identified at this time, and successful exploitation requires the victim to interact with the malicious content (UI:R).