Mozilla Firefox EUVD-2026-98527

Exploitation requires the victim to interact with attacker-controlled web content in Firefox (UI:R) - the user must visit or engage with a malicious page, so this cannot be triggered silently against an idle browser. No authentication or special privileges are needed (PR:N), and default configurations of Firefox are affected; the limiting factors are the mandatory user interaction and the fact that only limited confidentiality data is exposed (C:L, SSVC Technical Impact 'partial'). Affected versions are those prior to Firefox 158 and Firefox ESR 153.5.

This is a moderate-severity information disclosure flaw (CVSS 4.3) in Firefox's Networking component. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N indicates a network-reachable, low-complexity, unauthenticated issue, but exploitation requires user interaction (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. The signals are internally consistent and all point AWAY from high priority: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. No EPSS score was provided in the input, the CVE is NOT on the CISA KEV list, and no public proof-of-concept was referenced - so there is no public exploit identified at time of analysis. The combination of required user interaction, limited (partial) confidentiality-only impact, and no evidence of exploitation means this is a lower-priority, patch-in-normal-cycle issue rather than an emergency, despite the network attack vector. Note: no EPSS probability was supplied, so widespread-exploitation likelihood could not be quantified from the data provided.

An attacker lures a Firefox user to a malicious or attacker-influenced web page that abuses a flaw in the browser's networking handling to leak a limited amount of sensitive information (such as cross-origin or network-layer data) back to the attacker. Because UI:R applies, the victim must actively browse to or interact with the attacker's content; no public exploit code is known, and the disclosed data is partial rather than full confidentiality compromise.