Mozilla Firefox EUVD-2026-98651

Exploitation requires the victim to use an affected, unpatched version of Firefox (prior to 158) or Firefox ESR (prior to 115.43 or 153.5) and to actively load attacker-controlled web content - the CVSS UI:R and the client-side browser context mean the user must navigate to or render a malicious page for the Layout boundary condition to be triggered. No authentication is required (PR:N) and no special non-default Firefox configuration is indicated by the description, but the mandatory user interaction (visiting/rendering hostile content) is the primary factor limiting mass exploitation; there is no server-side or passive network vector.

This is a memory-safety flaw (incorrect boundary conditions, CWE-119) in Firefox's Layout engine, carrying a vendor CVSS of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The CVSS vector signals a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (UI:R) - consistent with a victim being lured to a malicious web page rather than wormable server-side exploitation. Counterbalancing the high CVSS, the EPSS score is very low at 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code is referenced in the provided data - so despite the high severity rating, no evidence of active or imminent exploitation exists at time of analysis. One internal inconsistency worth noting: the vendor marks A:N (no availability impact), which is unusual for a buffer-overflow/memory-corruption class bug that typically at minimum crashes the renderer; the C:H/I:H rating implies potential code execution, which usually carries availability impact as well - verify exact impact with Mozilla's advisory. Net assessment: a legitimately serious client-side browser bug given Firefox's enormous install base, but current real-world risk is moderated by the required user interaction and the absence of any exploitation or POC signal - patch on normal browser-update cadence rather than emergency timelines unless exploitation emerges.

An attacker hosts or compromises a web page containing specially crafted content that triggers the incorrect boundary condition in Firefox's Layout component when rendered. A victim running an unpatched Firefox visits the page (the UI:R user interaction), causing memory corruption that could lead to disclosure of in-process memory or arbitrary code execution in the content process. No public exploit code is identified at time of analysis, so this scenario is inferred from the CWE-119 class and CVSS vector rather than a demonstrated exploit.