Mozilla Firefox EUVD-2026-98525

Exploitation requires a victim running an unpatched Firefox (before 158) or Firefox ESR (before 153.5) to actively load attacker-controlled web content that exercises the Graphics: Text rendering component - this user interaction (UI:R) is a hard prerequisite, as the attacker cannot trigger the flaw without the browser navigating to malicious content. The dominant limiting factor is the high attack complexity (AC:H): because the bug is a race condition / use-after-free, successful exploitation depends on winning a non-deterministic timing window, which is not reliably reproducible and cannot be automated at scale (SSVC Automatable: no). No authentication is required (PR:N), but impact is bounded to partial confidentiality and integrity with no availability effect.

This is a genuinely low-to-moderate priority issue, and the available signals are consistent rather than conflicting. The CVSS 3.1 base score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R, a victim visiting attacker-controlled web content) AND high attack complexity (AC:H) - the latter directly reflecting the inherent difficulty of reliably winning the race condition / triggering the use-after-free (CWE-362). Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact claimed. CISA's SSVC framework corroborates the low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with AC:H - cannot be reliably weaponized at scale), and Technical Impact=partial (matching the C:L/I:L rating). There is no EPSS score, no CISA KEV listing, and no indication of public POC code in the provided data. No signals are in tension: a memory-safety bug in a browser graphics path that needs a race to be won and a user to visit a page is a real but hard-to-exploit defect. Priority should be routine patch-cycle remediation, not emergency response.

An attacker hosts a malicious web page containing specially crafted content that exercises the Graphics: Text rendering path and lures a Firefox user into visiting it. By precisely timing concurrent operations, the attacker attempts to win a race condition that frees a text-graphics object still in use, reading or corrupting a small amount of adjacent memory. No public exploit code is identified at time of analysis, and the high attack complexity means reliable exploitation is difficult.