Mozilla Firefox EUVD-2026-98528

Exploitation requires the victim to use Mozilla Firefox (versions prior to 158) and to actively load attacker-controlled content processed by the Site Reports component - the UI:R metric confirms user interaction (navigating to or opening malicious content) is mandatory, which limits mass automated exploitation (SSVC Automatable: no). No authentication is required (PR:N) and no special non-default configuration is indicated in the description. The impact is confined to availability of the client browser (A:H, C:N/I:N) with no scope change (S:U), so no persistence, data compromise, or lateral movement results; the realistic worst case is a browser crash or hang for the targeted user.

This is a medium-severity denial-of-service issue (CVSS 6.5) in Firefox's Site Reports component, mapped to CWE-400 (uncontrolled resource consumption). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction and impacts only availability (C:N/I:N) - consistent with a browser crash/hang rather than code execution or data exposure. Multiple risk signals align toward LOW real-world priority: CISA SSVC assesses Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no public exploit identified at time of analysis (not in CISA KEV, no POC referenced). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap. The signals are internally consistent (no exploitation observed, availability-only impact, interaction-gated), so this reads as a genuine but low-urgency vulnerability appropriately resolved through routine patching rather than an emergency. The primary mitigating factor is that impact is limited to availability of the client browser process, not the underlying system or other users.

An attacker hosts or injects malicious web content that, when a victim's Firefox browser renders it via the Site Reports component, triggers uncontrolled resource consumption causing the browser to hang or crash (denial of service). The attack requires the user to interact by visiting the attacker-controlled page (UI:R), and no authentication is needed. No public exploit code was identified at time of analysis.