Mozilla Firefox EUVD-2026-98640

Exploitation requires the victim to load attacker-controlled web content containing crafted XML that is parsed by Firefox's vulnerable XML component (UI:R in the CVSS vector) - there is no fully automatic, server-side or zero-click path implied by the data, and SSVC Automatable=no reflects this. No authentication is required of the attacker (PR:N), and no special victim-side configuration is named in the description, so default Firefox installs that render web XML are affected. The primary limiting factor is the mandatory user interaction (visiting or opening malicious content); impact is further bounded to partial (C:L/I:L/A:N), meaning this does not by itself yield full code execution or denial of service per the stated metrics. Affected scope is Firefox versions prior to 158 and ESR branches prior to 115.43 and 153.5.

This is a moderate-severity memory-safety flaw (CVSS 5.4) that does not rise to an urgent-priority issue based on the available signals, which are notably consistent with each other. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (UI:R) - i.e. the victim must load attacker-controlled web content. CISA's SSVC framework reinforces a non-urgent posture: Exploitation=none (no observed exploitation), Automatable=no (consistent with the UI:R requirement, since drive-by automation is limited by needing a user to visit a page), and Technical Impact=partial (matching the C:L/I:L/A:N 'low/low/none' impact rather than full code execution). No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The CVE is not listed in CISA KEV and no public proof-of-concept was supplied, so the exploitation status is 'no public exploit identified at time of analysis.' Taken together, the signals agree that this is a genuine but partial-impact use-after-free rather than a high-confidence, widely-weaponized threat. The one point worth noting: use-after-free bugs (CWE-416) in a browser can sometimes be escalated beyond the stated C:L/I:L/A:N impact depending on heap grooming, so the official 'partial' impact may be a conservative floor - verify against the Mozilla advisories if a worst-case assessment is needed.

An attacker hosts a web page containing crafted XML that triggers a use-after-free in Firefox's XML component; when a victim visits the page, the freed-memory reuse can leak small amounts of adjacent memory or corrupt state (limited confidentiality and integrity impact). Because UI:R applies, the attack depends on luring the user to the malicious content via a link, ad, or compromised site. No public exploit code was identified at the time of analysis.