EUVD-2026-98535
GHSA-r8c6-ghqq-cx8j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious website
-
ExploitServe crafted WebRTC content
-
ExecutionTrigger resource exhaustion in WebRTC
-
ImpactCrash or hang Firefox (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled web content that exercises the Firefox WebRTC component; the UI:R requirement means a user must actively navigate to or load the malicious page, so there is no server-side or fully passive trigger. No authentication is required (PR:N) and the affected default-enabled WebRTC stack needs no special configuration, but the user-interaction dependency and availability-only impact (crash/hang, no code execution or data exposure) are the primary limiting factors. Affected versions are Firefox before 158 and Firefox ESR before 153.5. |
| Impact | This is a medium-severity (CVSS 6.5) denial-of-service flaw in Firefox's WebRTC component (CWE-400, resource exhaustion). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H shows a network-reachable, low-complexity, unauthenticated vector whose only impact is availability (A:H), with confidentiality and integrity untouched - consistent with a crash/hang rather than code execution. The required user interaction (UI:R) meaningfully caps real-world risk, since a victim must actively load attacker-controlled content. These signals align rather than conflict: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', all pointing to low urgency. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced - exploitation status is therefore 'no public exploit identified at time of analysis'. Net assessment: a legitimate but low-priority browser availability bug, not a widespread-exploitation threat; patch during normal update cycles. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or malvertising/compromised site) containing crafted WebRTC content and lures a Firefox user to visit it. When the browser processes the content, the WebRTC component consumes excessive resources, crashing or hanging the browser. No public exploit code is identified, and exploitation requires the victim to actively load the attacker's content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A denial-of-service vulnerability in Mozilla Firefox's WebRTC component can cause the browser to hang or crash when a user opens a malicious web page that triggers resource exhaustion. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes released in Firefox 158 and Firefox ESR 153.5. No public exploit code or active exploitation has been identified, and the CVSS score is 6.5 (medium).
RemediationAI
Vendor-released patches are available: upgrade to Firefox 158 or Firefox ESR 153.5 or later. For organizations, deploy the updated versions through standard patch management and reference the Mozilla advisories at https://www.mozilla.org/security/advisories/mfsa2026-106/ and https://www.mozilla.org/security/advisories/mfsa2026-108/. As a compensating control, users can disable WebRTC by setting media.peerconnection.enabled to false in about:config, but this will break WebRTC-dependent features such as video conferencing and screen sharing. Enterprise administrators can enforce this via policies, but the trade-off is loss of legitimate real-time communication capabilities. Since exploitation requires user interaction, avoiding untrusted web content reduces risk, though it is not a complete mitigation. No other workaround is identified in the available data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in WebRTC, a real-time communication framework that enables audio, video, and data sharing directly between browsers. The root cause is classified as CWE-400 (uncontrolled resource consumption), meaning an attacker can force the browser to exhaust a resource such as memory or CPU, leading to a denial of service. According to the CPE string cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* and the independent assessment, the flaw affects Firefox before version 158 and Firefox ESR before version 153.5. Exploitation requires user interaction (UI:R) because the victim must load attacker-controlled web content; the CVSS vector shows PR:N (unauthenticated) and no impact to confidentiality or integrity. The attack is not automatable according to SSVC, and the technical impact is partial, limited to availability.
Know when Mozilla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Remotely reachable crafted web content (AV:N, AC:L, PR:N) but requires the user to load a malicious page (UI:R); availability-only crash (C:N/I:N/A:H), no scope change.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Exploit-DB