Mozilla Firefox EUVD-2026-98537

Exploitation requires the victim to use Firefox (versions prior to 158, or ESR prior to 153.5) and to visit or interact with attacker-controlled web content that exercises the Storage: IndexedDB component - the CVSS UI:R flag confirms user interaction is mandatory, which is the main limiting factor. No authentication is required of the attacker (PR:N, unauthenticated), and no special victim-side configuration is implied; IndexedDB is a standard, enabled-by-default web storage API. The attack cannot be automated at scale without per-victim interaction (SSVC Automatable=no), and impact is confined to partial confidentiality (information disclosure only).

This is a low-to-moderate severity issue, not a top priority. All signals align downward: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) scores 4.3 and limits impact to partial confidentiality loss only (C:L, I:N, A:N), and crucially requires user interaction (UI:R) - the victim must visit or interact with attacker-controlled content. CISA's SSVC framework corroborates this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited without per-victim interaction), and Technical Impact=partial. No KEV listing and no POC are present in the input, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified. There is no conflict between signals - network vector is consistent with a browser rendering remote web content, and the required user interaction is the primary limiting factor. The one caveat is that the description is terse ('Information disclosure in the Storage: IndexedDB component') and does not specify exactly what data is disclosed; the C:L rating suggests a bounded leak (e.g., cross-origin data or memory remnants) rather than full credential/session compromise.

An attacker hosts a malicious web page that abuses a flaw in Firefox's IndexedDB storage handling; when a victim visits the page, the page reads information it should not be able to access (e.g., data belonging to another origin or residual browser memory). No public exploit code is identified at time of analysis, and because user interaction is required (UI:R), the attacker must lure the victim to the page rather than exploit passively at scale.