Mozilla Firefox EUVD-2026-98646

Exploitation requires the victim to actively load attacker-controlled web content in Firefox (UI:R) that exercises the DOM Animation component; no authentication or special browser configuration is indicated, so default installations are affected. Limiting factors: the attack is not automatable (SSVC Automatable=no) and cannot succeed without user interaction, and impact is capped at limited information disclosure (C:L/I:L/A:N) rather than code execution. Fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5, so only versions below these fixes are exposed.

Signals are consistent and point to a moderate, non-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, score 5.4) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (the victim must load attacker-controlled content) and yields only low confidentiality and integrity impact with no availability impact. CISA's SSVC framework agrees on the modest ceiling: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit was referenced, so there is no evidence of active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here and should not be assumed low or high. One internal tension worth noting: the tags label this Memory Corruption / Use After Free (CWE-416), which can sometimes escalate to code execution, yet Mozilla assigned only C:L/I:L/A:N, indicating the real-world effect was scoped to limited information disclosure rather than full compromise - treat the memory-corruption framing as mechanism, not as confirmed RCE. Net: a legitimate browser memory-safety bug to patch on a normal cadence, not an emergency.

An attacker hosts a malicious web page that manipulates the DOM Animation component to trigger a use-after-free, then lures a Firefox user into visiting it (UI:R). Because no privileges are required (PR:N) and complexity is low (AC:L), any visitor is a potential target, but the resulting impact is limited to disclosing small amounts of process memory (C:L/I:L). No public proof-of-concept exploit was identified in the provided data.