Mozilla Firefox EUVD-2026-98638

Exploitation requires the victim to run an affected Mozilla Firefox build (any version prior to Firefox 158, Firefox ESR 115.43, or Firefox ESR 153.5) and to actively load attacker-controlled web content that executes JavaScript - this is the user-interaction requirement reflected by UI:R. No authentication or special configuration is needed on the target, and the flaw is reachable through the default JavaScript engine that runs on ordinary page visits. The principal limiting factor is that the attack is not zero-click: the user must navigate to or render the malicious page, so it depends on social engineering, malvertising, or a compromised/watering-hole site rather than unattended remote compromise.

Signals point to a genuine but not emergency-level risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity memory-safety flaw in Firefox's JavaScript engine that an unauthenticated attacker can trigger, but only with user interaction (the victim must load attacker-controlled web content). Mitigating signals dominate the real-world picture: EPSS is only 0.16% (4th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active or imminent exploitation. No SSVC decision data is present in the input to corroborate automatability or technical impact. The required user interaction (UI:R) and scope-unchanged (S:U) rating keep this below the zero-click drive-by tier. One internal tension to verify: for a CWE-119 boundary-condition bug in a JS engine one would often expect an availability impact (crash), yet the vendor-aligned vector lists A:N - suggesting Mozilla assessed the primary impact as information disclosure/integrity (e.g., out-of-bounds read/write usable for data exfiltration or exploit primitives) rather than a reliable crash; confirm the exact impact against the MFSA advisories. Overall: a legitimately high-severity browser bug warranting prompt patching as part of normal browser update cadence, but current exploitation signals indicate it is not a widespread active threat today.

An attacker hosts or compromises a web page containing malicious JavaScript and lures a Firefox user to visit it via a phishing link, malvertising, or a watering-hole site. When the victim's browser parses the crafted script, the incorrect boundary condition in the JavaScript engine is triggered, corrupting memory to leak or manipulate in-process data. No public exploit code was identified at the time of analysis, and a successful attack requires the user to actually load the malicious content (UI:R).