Mozilla Firefox EUVD-2026-98539

Exploitation requires the victim to interact with attacker-controlled or malicious web content that drives activity in Firefox's Networking: DNS resolution code path (UI:R). The flaw is a race condition (CWE-362), so the attacker must win a non-deterministic timing window - reflected in the high attack complexity (AC:H) and CISA's 'Automatable: no' rating - making reliable single-shot exploitation impractical and typically requiring repeated attempts. No authentication is needed (PR:N) and the vector is network-reachable (AV:N), but the limiting factors (required user interaction plus the inherent unreliability of winning the race) substantially constrain real-world exploitability. Impact is bounded to limited information disclosure and limited integrity effects with no availability impact. Affected versions are Firefox prior to 158; the issue is fixed in Firefox 158.

This is a genuinely low-to-moderate priority issue, not a high-severity emergency. The input CVSS base score of 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) is internally consistent: network vector but high attack complexity (AC:H, typical of a race condition that must be won non-deterministically) and required user interaction (UI:R, i.e. the victim must browse to or interact with attacker-influenced content). Impact is limited to low confidentiality and low integrity with no availability effect, matching the 'Information Disclosure' tag. CISA's SSVC decision framework corroborates the low urgency: Exploitation=none, Automatable=no, Technical Impact=partial - the 'not automatable' value aligns directly with the AC:H race-condition difficulty, and 'partial' matches C:L/I:L. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no quantitative exploitation-probability signal to weigh. No public exploit was identified in the provided data. In short, all available signals point the same way (hard to exploit, limited impact, no evidence of exploitation), so there is no conflict to flag - this reads as a defense-in-depth browser hardening fix rather than an actively dangerous flaw. The main caveat is missing data: no EPSS and no POC status were supplied, so the exploitation-likelihood picture is inferred from CVSS/SSVC rather than measured.

An attacker lures a victim to a malicious or compromised web page and repeatedly triggers DNS resolution activity, attempting to win a timing race in Firefox's DNS networking component to leak or corrupt a small amount of in-memory data. Because the attack depends on winning a non-deterministic race (AC:H) and requires the victim to actively interact with attacker content (UI:R), success is unreliable and would likely require many attempts. No public exploit code was identified at time of analysis.