Mozilla Firefox EUVD-2026-98636

Exploitation requires the victim to actively load attacker-controlled web content in Firefox so the Graphics: Text component renders a malicious payload - the UI:R metric and the rendering component confirm user interaction (visiting a page or opening content) is mandatory; there is no server-side or unauthenticated-daemon exposure. Limiting factors: the attack only affects users on unpatched Firefox prior to 158, ESR before 115.43, or ESR before 153.5, and impact is bounded to limited confidentiality/integrity with no availability effect, likely constrained by browser memory-safety mitigations. No special non-default configuration is required beyond normal web browsing.

This is a moderate-severity memory-safety issue that does not currently rise to the level of an urgent, must-patch-now priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction - consistent with a victim visiting or rendering attacker-controlled web content in Firefox. All signals point the same direction and are mutually consistent: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial', which aligns with the limited low/low confidentiality and integrity impact and no availability impact. There is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. The one nuance worth flagging: CWE-416 use-after-free in a graphics/text rendering path is the classic primitive attackers chain toward code execution, yet Mozilla scored impact as only low C/low I with no availability effect - this suggests either mitigations (e.g., site isolation, hardened allocators) constrain the primitive, or the vendor assessed it as an info-leak rather than a reliable RCE. The 'Information Disclosure' tag supports the info-leak reading. Net: a real but routine browser memory-safety bug best handled through normal patch cadence, not emergency response.

An attacker hosts a malicious web page containing specially crafted graphics/text content and lures a Firefox user to visit it (UI:R). Rendering the content triggers a use-after-free in the Graphics: Text component, allowing the attacker to read small amounts of out-of-bounds memory or corrupt limited process state, consistent with the low confidentiality/integrity impact. No public exploit code was identified, so weaponization effort remains unproven.