Mozilla Firefox EUVD-2026-98643

Exploitation requires a user to actively load attacker-controlled web content in Firefox that exercises the vulnerable DOM: Core & HTML code path triggering the use-after-free (UI:R). No authentication or prior privileges are needed (PR:N) and the attack is network-delivered (AV:N), so any default Firefox installation that browses to a malicious or compromised page is in scope - no non-default feature or configuration setting is named in the advisory. The principal LIMITING factors are the mandatory user interaction (the victim must visit the page), the impact ceiling (partial confidentiality/integrity only, no availability per A:N), and the patch being already available: upgrading to Firefox 158, Firefox ESR 115.43, or Firefox ESR 153.5 fully remediates it.

This is a moderate-severity, low-real-world-priority issue despite being a memory-corruption class (CWE-416 use-after-free). The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable flaw that an unauthenticated attacker can trigger but that REQUIRES user interaction (UI:R) and yields only partial confidentiality and integrity impact with no availability impact - consistent with an information-disclosure-style memory leak rather than reliable code execution. All signals agree this is not an urgent priority: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and the input provides no EPSS score, no KEV listing, and no evidence of public exploit code. There is no conflict between the CVSS network vector and the description - a user visiting a malicious web page is the natural delivery path for a browser DOM bug, which fully explains the AV:N/UI:R combination. The one note of caution is inherent to the bug class: use-after-free conditions in a browser DOM engine are historically a favored primitive for building more serious exploit chains, so the modest 'C:L/I:L/A:N' impact rating may understate worst-case potential if combined with other bugs; however, nothing in the supplied data indicates weaponization. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified here.

An attacker hosts a malicious web page containing crafted DOM/HTML content that triggers the use-after-free in Firefox's DOM Core & HTML component, then lures a victim into visiting it. When the freed object is reused, the attacker can read fragments of adjacent memory, potentially disclosing sensitive in-process data. No public exploit code was identified in the provided data, and user interaction (visiting the page) is required.