Mozilla Firefox EUVD-2026-98637

Exploitation requires the victim to use Mozilla Firefox and to visit or render attacker-controlled web content that exercises the vulnerable Graphics component (UI:R - user interaction such as navigating to a malicious page is mandatory). No authentication or prior privileges are needed (PR:N), and default configurations are affected since the Graphics component is a core rendering path. The principal limiting factor is the required user interaction, which prevents fully automated, zero-click mass exploitation; additionally, only unpatched versions below Firefox 158 / ESR 115.43 / ESR 153.5 are affected, and the Low impact metrics constrain the practical payoff of a successful exploit.

This is a moderate-severity, low-priority issue in practice. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated bug that requires user interaction (UI:R) - consistent with a browser flaw triggered by visiting a malicious page - with a scope change (S:C) that aligns with the described sandbox escape crossing the content-process boundary. However, the impact metrics are all Low (C:L/I:L/A:L), not High, which tempers the raw score. Exploitation signals are weak and mutually reinforcing: EPSS is only 0.19% (8th percentile), the CVE is NOT in CISA KEV, and no public exploit code was identified in the provided data. There is no conflict between signals - all of them point to low real-world exploitation likelihood. One minor tension worth noting: the description calls this a 'Sandbox escape' while the input Tags label it 'Information Disclosure'; the Low confidentiality impact and CWE-908 (uninitialized memory) make limited information disclosure plausible, but a full sandbox escape typically implies broader consequences than the C:L/I:L/A:L vector suggests - verify scope of impact against the Mozilla advisories. Net: a legitimate memory-safety bug to patch on normal browser-update cadence, not an emergency.

An attacker hosts a malicious web page containing crafted graphics content that triggers use of uninitialized memory in Firefox's Graphics component. When a victim visits the page (UI:R), the flaw allows the attacker to cross the browser sandbox boundary and leak limited memory contents or affect host-side state. No public proof-of-concept or exploit code was identified in the available data.