Mozilla Firefox EUVD-2026-98649

Exploitation requires the victim to use an unpatched Firefox build (prior to Firefox 158, ESR 115.43, or ESR 153.5) and to load attacker-controlled web content that exercises the DOM Streams API - the use-after-free is reached through normal web-content JavaScript, so no special Firefox configuration or feature toggle is named in the advisory. The principal limiting factor is mandatory user interaction (UI:R): the attacker must get the user to visit or render the malicious page. Reliability is further constrained because use-after-free exploitation depends on specific object-lifetime/heap timing within the content process, and impact is limited (partial technical impact, C:L/I:L/A:N), pointing to limited memory/information disclosure rather than straightforward code execution.

This is a moderate-severity, memory-safety issue that does NOT appear to be an active-exploitation priority based on the available signals. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates a network-reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R) - i.e. the victim must be lured into loading attacker-controlled web content. The SSVC decision framework corroborates a low operational urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited), and Technical Impact=partial (consistent with the C:L/I:L/A:N limited-impact rating). No CISA KEV listing and no EPSS score were provided, and no POC reference is present among the sources, so there is no evidence of in-the-wild or weaponized exploitation. One point of tension to verify: the CVSS vector rates complexity as AC:L, but use-after-free (CWE-416) exploitation in a modern browser realistically depends on precise heap/object-lifetime timing, which usually raises real-world exploitation difficulty - my independent assessment therefore leans AC:H. Likewise, the vector assigns A:N (no availability impact) even though UAF conditions frequently cause crashes; Mozilla's rating treats this primarily as an information-disclosure/limited-corruption issue, consistent with the 'Information Disclosure' tag. Bottom line: a legitimate browser patch worth applying in routine update cycles, but not an emergency given UI:R, non-automatable status, and absence of KEV/POC/EPSS signals.

An attacker hosts or compromises a web page containing JavaScript that manipulates the DOM Streams API to trigger the use-after-free, then entices a Firefox user to visit it (UI:R). Because privileges are not required (PR:N) and the vector is network-based (AV:N), simply loading the malicious content could cause the freed object to be reused, potentially leaking small amounts of memory (C:L/I:L). No public exploit code was identified at time of analysis, and exploitation would require reliable heap manipulation within the browser.