Mozilla Firefox EUVD-2026-98639

Exploitation requires the victim to actively load attacker-controlled web content in an unpatched Firefox (UI:R) - there is no server-side or passive network exploitation path. The vulnerable code is the JavaScript engine processing attacker-supplied script, so JavaScript must be enabled (the default). No authentication or pre-existing privileges are needed (PR:N). Limiting factors: affected versions are those prior to Firefox 158, ESR 115.43, and ESR 153.5, so patched or auto-updated installs are not exploitable; the mandatory user-interaction step (visiting a malicious/compromised page) means it cannot be triggered unattended; and because the vendor rates availability impact as none, the realistic outcome is memory disclosure/integrity corruption rather than guaranteed crash or confirmed remote code execution.

Signals are consistent and point to a genuine-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 HIGH) describes a remotely reachable, low-complexity, unauthenticated memory-safety flaw in Firefox's JavaScript engine that nonetheless requires user interaction (UI:R) - i.e. the victim must load attacker-controlled web content. That UI:R requirement is the single biggest brake on real-world risk. The EPSS score is very low (0.16%, 4th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. These exploitation signals align rather than conflict: a browser memory-corruption bug that is non-trivial to weaponize and not yet publicly exploited. Note a minor internal tension worth flagging: the CWE-119 buffer-overflow class and 'incorrect boundary conditions' description would typically enable availability impact (crashes) and often code execution, yet Mozilla's vector rates A:N - suggesting the demonstrated impact is information disclosure / integrity corruption rather than a clean crash-to-RCE; treat RCE potential as plausible-but-unconfirmed and defer to Mozilla's advisory. Overall: patch promptly on the normal browser-update cadence, but this is not a drop-everything KEV-class emergency.

An attacker hosts a malicious web page (or injects malicious script into a compromised/ad-served context) containing JavaScript crafted to trigger the boundary-condition flaw in the JS engine. When a victim running an unpatched Firefox visits the page, the out-of-bounds access corrupts memory, potentially leaking sensitive in-process data or corrupting integrity-sensitive state. No public proof-of-concept is referenced, and successful exploitation hinges on the user actively loading the attacker's content.