Mozilla Firefox EUVD-2026-98538

Exploitation targets the WebExtensions component of Mozilla Firefox before version 158 and Firefox ESR before 153.5. The decisive limiting factor is required user interaction (CVSS UI:R) - the victim must perform an action such as visiting attacker-controlled content, so there is no fully drive-by, zero-click path. No authentication is required (PR:N), and the attack is network-reachable against default Firefox installations without any special configuration flag noted in the advisory. Upgrading to Firefox 158 or ESR 153.5 removes the condition entirely.

This is a genuine high-priority patch item but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction, yielding total confidentiality, integrity, and availability impact - consistent with CWE-269 (Improper Privilege Management) and the vendor-assigned 'total' technical impact in CISA's SSVC framework. However, the exploitation signals temper the raw severity: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing and no EPSS score supplied, and no public exploit identified at time of analysis. The SSVC 'Automatable: no' value aligns logically with the UI:R requirement - exploitation cannot be reliably mass-automated because it depends on tricking a user. The practical read is: a serious privilege-escalation bug in a ubiquitous browser that warrants prompt patching, but current intelligence shows no evidence of active exploitation or weaponization, so it is a high-CVSS issue without (yet) a high real-world-exploitation signal. Note the description is extremely terse ('Privilege escalation in the WebExtensions component'), so the specific escalation boundary (web-content-to-extension, extension-to-browser, or sandbox escape) cannot be confirmed from the provided data.

An attacker lures a Firefox user to a malicious web page or induces installation/activation of crafted content that abuses the WebExtensions component to escalate privileges beyond the normal web-content sandbox, gaining the elevated capabilities of extension or browser context. Because UI:R is required, the victim must take an action such as visiting the page or interacting with a prompt. No public exploit has been identified at time of analysis.