Mozilla
Monthly
Improper authentication in the SAML SSO identity-linking flow of self-hosted Sentry 26.5.0 through 26.7.1 lets an attacker who controls a SAML identity provider trick an already-authenticated user into opening a crafted URL, link the attacker's federated identity to that user's Sentry account, and achieve full account takeover (CVSS 4.0 base 7.6, High; independent assessment CVSS 3.1 7.6 with C:H/I:H). Exploitation is constrained by two prerequisites: the victim's browser must accept the cross-site cookie context (Firefox sending SameSite=None cookies, or Chromium with third-party cookies explicitly enabled, which is not the Chromium default), and the target deployment must have SAML SSO configured, so the realistically reachable population is narrower than the raw score suggests. Sentry SaaS was remediated on July 27, 2026 and is not affected; self-hosted instances are fixed in 26.7.2, and no public exploit code was identified at time of analysis.
Privilege escalation in Mozilla Firefox's WebExtensions component allows remote attackers to reach high confidentiality, integrity, and availability impact inside the browser's privileged context, provided the victim performs an interaction such as visiting attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8). Unauthenticated attackers can reach the flaw over the network against default installations, but the required user interaction rules out a zero-click drive-by path. All Firefox builds before 158 and Firefox ESR builds before 153.5 are affected; upgrading to 158 or ESR 153.5 removes the condition. There is no public exploit identified at time of analysis and CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', making this a genuine high-priority patch item rather than an emergency.
Sandbox escape in Mozilla Firefox allows attacker-controlled web content to break out of the browser's content sandbox by winning a timing-dependent race condition in the Networking component (CWE-362), rated CVSS 8.3 with scope change (S:C), meaning compromise extends beyond the sandboxed process. Exploitation is unauthenticated (PR:N) and remote (AV:N) but requires the victim to load attacker-controlled web content (UI:R) and is unreliable per attempt due to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.16% (5th percentile); the vulnerability is fixed in Firefox 158 and Firefox ESR 153.5.
Privilege escalation in the DOM: Navigation component of Mozilla Firefox (prior to 158) and Firefox ESR (prior to 153.5) lets an unauthenticated attacker gain elevated privileges inside the browser when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-269). The sole gate on exploitation is user interaction (UI:R, PR:N): the victim simply has to render a hostile or compromised page in an unpatched build, with no authentication, special configuration, or local access required. No public exploit code has been identified at time of analysis, and CISA's SSVC triage records exploitation as "none" with technical impact "total" and automatable as "no"; combined with the absence of KEV listing and EPSS data, this reads as a genuinely high-severity but not yet demonstrably exploited issue whose urgency depends on future exploit development. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and upgrading fully removes the exposure.
A sandbox escape in Mozilla Firefox's DOM Content Processes component lets a remote, unauthenticated attacker break out of the content-process sandbox if a victim merely renders attacker-controlled web content in any Firefox build prior to 158 (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the score is scope-changed, a successful escape grants impact outside the sandboxed content process - high confidentiality, integrity and availability effects on the host rather than on the page alone - but in practice the escape generally has to be paired with a separate content-process code-execution flaw to convert the boundary crossing into full code execution. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.19% (8th percentile), and the mandatory user interaction of loading the malicious page is the main practical constraint on real-world exploitation.
Privilege escalation in Mozilla Firefox's Panning and Zooming component lets an attacker who gets a target to render crafted content cross a privilege boundary inside the browser, with high impact to confidentiality, integrity and availability (CVSS 8.8). Affected builds are Firefox before 158 and Firefox ESR before 153.5, which Mozilla fixed via advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile), but the input vector and our independent assessment disagree on the exploit preconditions (PR:L/UI:N versus PR:N/UI:R), so reconcile those signals before prioritization; authentication requirements are not confirmed from available data.
Privilege escalation in Mozilla Firefox's WebExtensions component allows an extension-level actor to gain capabilities beyond those it was granted, yielding high confidentiality and integrity impact; all Firefox builds prior to version 158 are affected, with the fix delivered in Firefox 158 via Mozilla security advisories mfsa2026-106 and mfsa2026-109. Exploitation requires a low-privileged foothold - in practice an already-installed malicious or compromised browser extension reaching the vulnerable privilege-management code path (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) - and no public exploit code has been identified at time of analysis. EPSS is low at 0.16% (4th percentile) and the flaw is not listed in CISA KEV; signals are mixed and point to a moderate, not emergency, priority, with the AV:N rating questionable for an extension-context escalation and worth verifying with Mozilla.
Privilege escalation and information disclosure in Mozilla's Process Sandboxing component let attacker-controlled web content break out of the Firefox content-process sandbox on unpatched installations - Firefox before 158 and Firefox ESR before 153.5 - with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is remote and requires no attacker authentication, but it is user-driven: the victim must actively load the malicious page, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a targeted client-side risk rather than a mass-exploitation candidate. There is no public exploit identified at time of analysis, and vendor-released fixes ship in Firefox 158 and Firefox ESR 153.5 (MFSA 2026-106 and MFSA 2026-108).
A sandbox escape in Mozilla Firefox's Networking component allows unauthenticated remote attackers to break out of the browser's security sandbox and potentially execute code on the host when a victim loads attacker-controlled web content. The vulnerability stems from incorrect boundary conditions (CWE-119) and carries a CVSS score of 9.6, though exploitation requires user interaction (UI:R) and the sandbox escape alone must be chained with a separate content-process code-execution primitive for full host compromise. No public exploit code has been identified, and the EPSS score is low at 0.19% (8th percentile); patched versions are Firefox 158 and Firefox ESR 153.5.
A use-after-free in Mozilla Firefox's Networking component can be escalated into a sandbox escape, meaning a malicious page can corrupt freed memory and break out of the browser's content-process sandbox to reach higher-privileged code. Affected are Firefox builds prior to 158 and Firefox ESR builds prior to 153.5; no authentication is required, but exploitation depends on the victim navigating to attacker-controlled web content (UI:R), consistent with the assessed CVSS:3.1 vector of 9.6 and the SSVC 'not automatable' rating. Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5; at time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed in-the-wild activity.
Sandbox escape and site-isolation bypass in Mozilla Firefox allow unauthenticated remote attackers to break the browser's security boundary by triggering a use-after-free in the Networking component. Affected are Firefox versions before 158 and Firefox ESR before 153.5; exploitation requires the victim to load attacker-controlled web content, meaning no autonomous trigger exists. No public exploit identified at time of analysis, though the 9.6 CVSS score and total technical impact warrant urgent patching.
Privilege escalation in Mozilla Firefox's Application Update component allows a locally present, low-privileged attacker to elevate their privileges on the affected host, with the input CVSS 3.1 score of 8.8 (High) reflecting complete confidentiality, integrity, and availability impact. Exploitation requires only low privileges with no user interaction and is limited to unpatched builds prior to Firefox 158 and Firefox ESR 153.5; systems updated to those versions are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) signal, with the EPSS score remaining low at 0.19% (8th percentile).
Memory corruption in Mozilla Firefox's Layout engine lets a remote, unauthenticated attacker who convinces a victim to render attacker-controlled web content corrupt memory, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicating high confidentiality and integrity impact and a full availability impact on the client. All Firefox builds prior to 158 are affected, along with Firefox ESR releases prior to 115.43 and 153.5. Exploitation hinges entirely on user interaction - the victim must navigate to or render a hostile page - and no public exploit or active exploitation has been identified at time of analysis; EPSS is low at 0.16% (5th percentile), and vendor-released fixes (Firefox 158, ESR 115.43, ESR 153.5) are available per Mozilla advisories mfsa2026-106 through mfsa2026-110.
A type-confusion miscompilation in Mozilla Firefox's JavaScript JIT engine (CWE-843) lets remote attackers corrupt memory and potentially read or modify data inside the browser process when a user loads attacker-controlled JavaScript. Exploitation is unauthenticated over the network (PR:N) but requires user interaction (UI:R) - the victim must visit or render hostile content with JavaScript enabled on an unpatched build. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; no public exploit code or confirmed active exploitation has been identified, and the EPSS score is low at 0.16% (5th percentile), making this a serious but not emergency-tier browser flaw.
Integer overflow in Mozilla Firefox's Graphics component (CWE-190) can lead to memory corruption and potential remote code execution when a user loads a malicious web page. Affected versions are prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; exploitation requires user interaction (UI:R) and no authentication. No public exploit code has been identified, and the EPSS score is low at 0.16% (5th percentile), though the vulnerability is rated high severity (CVSS 8.8).
JIT miscompilation in Mozilla Firefox's JavaScript engine can cause the browser to generate incorrect native code for attacker-supplied scripts, giving a malicious page high confidentiality and integrity impact within the affected browsing context. The flaw affects Firefox builds prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5; exploitation is remote and requires no credentials (PR:N) but is gated by user interaction, since the victim must load attacker-controlled web content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1). No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), but vendor-released patches exist in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Mozilla Firefox releases prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5 contain incorrect boundary conditions in the JavaScript engine that let remote attackers corrupt or disclose memory when a user loads attacker-controlled web content. Because the weakness sits in script processing, no credentials or pre-existing privileges are needed - but exploitation is not unattended: the victim must actively browse to a malicious or compromised page with JavaScript enabled (the default), and the vendor rates availability impact as none, so the realistic outcome is memory disclosure/integrity corruption rather than a guaranteed crash or confirmed remote code execution. Publicly available exploit code has not been observed and there is no public exploit identified at time of analysis; CISA KEV does not list this CVE, and EPSS is only 0.16% (4th percentile), so this is a genuine patch-promptly issue rather than an emergency one.
Memory corruption in Mozilla Firefox's JavaScript engine can be triggered when a remote unauthenticated attacker convinces a user to load attacker-controlled JavaScript content, yielding high confidentiality and integrity impact with no availability impact. This is not a zero-click attack; exploitation requires user interaction (UI:R) to render a malicious page, so it depends on social engineering, malvertising, or a compromised site. Mozilla fixed the issue in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; at time of analysis there is no public exploit identified, and EPSS is very low at 0.16% (4th percentile), indicating a genuine but not emergency-level risk.
Sandbox escape in the Mozilla Firefox Graphics component allows an attacker who can get a victim to render attacker-controlled web content to break out of the browser's content-process sandbox, with Low-rated confidentiality, integrity and availability impact but a changed security scope. Affected are unpatched Firefox builds below 158 and ESR builds below 115.43 and 153.5; no authentication is required, but exploitation is gated by mandatory user interaction (UI:R) such as visiting a crafted page, which precludes zero-click mass exploitation. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), making this a moderate-severity but low-priority issue in practice; vendor-released patches are available.
Firefox for iOS versions prior to 157.1 interpolate a page's HTML lang attribute directly into the browser's translation JavaScript, so crafted markup in that attribute executes as code inside Firefox's privileged content world and escapes the page's Content Security Policy - a scope-changing outcome in the independent assessment. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: the victim must open an attacker-controlled or compromised page and cause the page-translation feature to process it, and CISA's SSVC rates the flaw as not automatable. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the vendor fixed it in Firefox for iOS 157.1, so the practical priority is prompt upgrade rather than emergency response.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Mitigation bypass in Mozilla Firefox's File Handling component affects Firefox builds prior to 157.0.1 and lets an attacker defeat a protection mechanism that Firefox relies on when a user opens, downloads, or otherwise processes an attacker-supplied file. The input CVSS 3.1 vector rates this 9.8 CRITICAL, but the supporting evidence contradicts that: the vulnerability is a CWE-693 protection-mechanism failure whose practical impact depends on chaining it with a second attack rather than achieving standalone compromise, it is client-side and requires user interaction with malicious content, and the independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Exploitation is unauthenticated per the vector (PR:N), exploitation is not automatable against a server, EPSS is a low 0.14% (3rd percentile), SSVC records Exploitation: none, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. A vendor patch is available in Firefox 157.0.1, so patched users are not exposed.
Unauthenticated remote code execution affects Taskcluster deployments running versions prior to 100.3.0 that expose the GraphQL endpoint to an anonymous role. The vulnerable code path is the GraphQL `filter: JSON` argument on list/search queries (clients, roles, secrets, worker pools, denylist addresses, artifacts, hooks, namespaces), which was parsed with the `sift` library using improper input validation (CWE-20); a crafted filter payload can lead to code execution on the web-server, giving full confidentiality, integrity, and availability impact (assessed CVSS 3.1 9.8, raw vendor CVSS 4.0 8.7). Exploitation is network-reachable and needs no authentication or user interaction, but is conditional on the deployment granting an anonymous role access to GraphQL; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the vendor-released patch is version 100.3.0.
Memory corruption in Mozilla Firefox ESR's Graphics: Canvas2D component allows remote attackers to execute code within the browser content process when a victim is induced to load attacker-controlled web content; the root cause is a use-after-free (CWE-416) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability loss inside the exploited process. Affected builds are ESR 115.x before 115.42, ESR 140.x before 140.17, and ESR 153.x before 153.4, with vendor fixes released in Firefox ESR 115.42, 140.17, and 153.4. Exploitation requires victim interaction (loading a malicious or compromised page) and is unauthenticated over the network (PR:N); no public exploit code was identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with 'no' automatable applicability and total technical impact.
Use-after-free in Mozilla Firefox's DOM UI Events and Focus Handling code allows a remote, unauthenticated attacker to corrupt the browser's heap and potentially achieve code execution in the content process when a victim loads attacker-controlled web content. The flaw affects Firefox builds before 157 and Firefox ESR before 153.4, where it has been fixed; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction (opening the page) being the primary precondition, and CISA's SSVC assessment does not consider it automatable. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so despite the high base score this reads as a medium-priority memory-corruption flaw in an ubiquitous browser rather than an emergency, actively exploited issue.
Origin-separation mitigation bypass in Mozilla Firefox before 157 and Firefox ESR before 153.4 permits unauthenticated remote attackers to defeat DOM Navigation protections by luring a victim to load attacker-controlled web content, potentially compromising confidentiality and integrity of cross-origin data or actions if the victim is simultaneously authenticated to a targeted site. Although the CVSS base score is 8.1, the vector requires user interaction (UI:R), EPSS is only 0.15% (4th percentile), and no public exploit has been identified at time of analysis, making this a genuine but non-emergency browser vulnerability. CISA SSVC records no exploitation and no automatable exploitation, while noting total technical impact.
Unauthenticated remote attackers can bypass a DOM:Security mitigation in Mozilla Firefox (versions before 157 and Firefox ESR before 153.4) by enticing a victim to load attacker-controlled web content, defeating a browser protection mechanism rather than exploiting a memory-safety bug directly. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) and a scope change indicate high potential confidentiality, integrity and availability impact once the defense is circumvented, but the independent assessment characterizes this as a weakening primitive: full impact generally requires chaining with a separate content-process vulnerability, so it is not a self-contained compromise. Exploitation signals conflict sharply - a critical-looking CVSS score against an EPSS of only 0.15% (4th percentile), a CISA SSVC rating of Exploitation: none / Automatable: no, and no public exploit identified at time of analysis; there is no confirmed actively exploited (CISA KEV) status.
Mitigation bypass in Mozilla Firefox's Bookmarks & History component lets attacker-controlled web content defeat a built-in browser security protection, weakening the defenses that normally contain malicious pages. The issue affects Firefox builds prior to 157 and Firefox ESR builds prior to 153.4, is reachable without authentication (PR:N) but requires the victim to load attacker-supplied content (UI:R), and is confirmed fixed by the vendor in Firefox 157 and Firefox ESR 153.4. Independent assessment rates the real-world consequence as limited (C:L/I:L/A:N) because bypassing the protection alone yields little damage and must be chained with a separate content-process vulnerability to reach the headline CVSS 9.6 impact; EPSS is 0.15% (4th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
Use-after-free in the JavaScript JIT compiler of Mozilla Firefox (versions before 157) and Firefox ESR (before 153.4) allows remote attackers to corrupt memory and potentially execute code within the browser process when a victim loads attacker-controlled JavaScript from a malicious or compromised page. Exploitation requires user interaction (the victim must navigate to the crafted content), and while CVSS 8.8 indicates high confidentiality, integrity, and availability impact, no public exploit code or active exploitation in the wild has been identified at the time of analysis. The flaw is fixed in Firefox 157 and Firefox ESR 153.4.
Privilege escalation in Mozilla Firefox's Places component lets a remote attacker reach elevated, normally chrome-restricted functionality inside the browser when a victim opens attacker-controlled web content in an affected build. Affected releases are Firefox versions before 157 and Firefox ESR versions before 153.4, rated 8.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which means no attacker-side authentication or privileges are required but the victim must be induced to interact with a crafted page, after which confidentiality, integrity and availability impact is total within the affected security scope (CWE-269 improper privilege management). There is no public exploit identified at time of analysis and no CISA KEV entry; CISA SSVC rates exploitation as "none" and the attack as not automatable, so this is a serious browser flaw rather than a current worm or mass-exploitation emergency, and it is fully resolved by updating to Firefox 157 or Firefox ESR 153.4.
Privilege escalation in the Mozilla Firefox Address Bar component lets a remote, unauthenticated attacker gain elevated privileges within the browser by persuading a victim to load and interact with attacker-controlled web content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms no credentials are needed but the attack cannot succeed without the targeted user interacting with the malicious page, and CISA's SSVC assessment marks the issue as not automatable with no observed exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis; the flaw is remediated in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17, so only unpatched installations prior to those builds remain exposed.
Sandbox escape in Mozilla Firefox stems from improper boundary checks in the XPCOM component, allowing remote attackers to break out of the browser's content sandbox and compromise the host when a victim loads attacker-controlled web content. The flaw carries a CVSS 9.6 with required user interaction (UI:R) and no authentication (PR:N), affecting unpatched versions below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42. No public exploit identified at time of analysis, and CISA SSVC records Exploitation: none, so this is a high-severity patching priority rather than a confirmed active threat.
A use-after-free in Mozilla Firefox's Widget:Gtk component enables a sandbox escape: an unauthenticated remote attacker who persuades a user to load attacker-controlled web content can corrupt freed heap memory in the GTK widget rendering path and cross the browser's security boundary (CVSS 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), turning a rendering bug into code-execution-class impact outside the sandbox. GTK-based (Linux/Unix) Firefox builds are the primary target surface, and the flaw affects Firefox releases prior to 157 as well as the ESR branches prior to 153.4 and 140.17, where Mozilla has shipped the fix. No public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automation rated 'no', although the assessed technical impact is total if the bug is successfully triggered; the principal hurdles are the required user interaction and the difficulty of reliably grooming a UAF into a working sandbox escape.
Cross-origin data exposure and integrity compromise in Mozilla Firefox stem from a site-isolation failure in the DOM:Networking component, where origin boundaries are not correctly enforced, allowing attacker-controlled web content to reach resources and operations that should belong to a different origin. Affected are Firefox builds before 157 and Firefox ESR builds before 153.4; the issue is rated 8.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), meaning remote, unauthenticated, low-complexity exploitation that nonetheless requires the victim to load a malicious or compromised page. There is no public exploit identified at time of analysis and EPSS is very low at 0.15% (4th percentile), so real-world activity is not indicated, but the confidentiality and integrity impact is high once a user is lured to attacker-controlled content.
Use-after-free in Mozilla Firefox's CSS Parsing and Computation component allows a remote attacker to corrupt browser memory and potentially achieve code execution in the content process by getting a victim to render attacker-controlled web content. The flaw affects Firefox before 157 and Firefox ESR before 153.4 (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), and although no authentication or non-default configuration is required, exploitation is not zero-click - the target must actually load the malicious page, win the use-after-free race, and defeat browser memory hardening. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score or KEV listing was provided, so this sits in the high-CVSS but moderate-real-world-priority band rather than an emergency-patch category.
Remote code execution in Mozilla Firefox's SpiderMonkey JavaScript JIT engine allows unauthenticated attackers to corrupt memory via crafted web content, potentially leading to arbitrary code execution within the browser's content process. Exploitation requires the victim to visit or be redirected to a malicious page (UI:R) that triggers incorrect boundary conditions during JIT compilation; JIT is enabled by default, so no special victim configuration is needed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is near-critical due to the high-value JIT attack surface. Fixed in Firefox 157 and Firefox ESR 153.4.
Remote code execution within the browser process could be achieved in Mozilla Firefox before version 157 through an invalid pointer release in the JavaScript JIT compiler. A remote, unauthenticated attacker can trigger this by convincing a user to visit a malicious webpage, requiring user interaction but no privileges. No public exploit code has been identified at time of analysis, and the CVSS base score is 8.8.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the DOM: Core & HTML component, allowing attacker-controlled web content to corrupt memory and break out of the browser's content-process sandbox. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17; the flaw carries a CVSS 9.6 rating (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the scope change (S:C) reflects escape from the renderer sandbox into the wider browser/OS context with high confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV; however, exploitation only requires a victim to load attacker-controlled content (UI:R) and needs no authentication or non-default configuration, so browser auto-update to a fixed build fully removes exposure.
Information disclosure in Mozilla Firefox DevTools versions prior to 157 allows an unauthenticated remote attacker to potentially expose sensitive data when a victim interacts with the browser's developer tools while viewing attacker-influenced content. Exploitation requires user interaction (UI:R) and is client-side only; no public exploit code has been identified at time of analysis (EPSS 0.15%, percentile 4%). The vulnerability is fixed in Firefox 157.
A same-origin policy bypass in Firefox's DevTools component allows attacker-controlled content to read and modify data belonging to other origins the victim is already authenticated to, rated CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The flaw affects Firefox builds before 157 and Firefox ESR builds before 153.4; exploitation is remote and requires no attacker-side credentials, but is gated by user interaction because the victim must load attacker-controlled content and reach the vulnerable DevTools same-origin-policy code path. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), while Mozilla has shipped vendor fixes in Firefox 157 and Firefox ESR 153.4.
Improper enforcement of a built-in DOM security mitigation in Mozilla Firefox's Service Workers component allows remote, unauthenticated attackers to bypass that protection when a victim loads attacker-controlled web content, with a successful bypass potentially yielding high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires the user to visit a malicious or compromised page that registers or abuses a Service Worker (UI:R, PR:N); the underlying CPE confirms only the Mozilla Firefox browser family (versions before 157 and before ESR 153.4) is affected. At time of analysis there is no public exploit identified and no confirmed active exploitation, EPSS is low at 0.16% (4th percentile), and CISA SSVC rates exploitation as 'none' and automatable as 'no', indicating a moderate rather than emergency priority. Because this is a protection-mechanism bypass (CWE-693), realistic full impact likely depends on chaining with a second flaw rather than standalone compromise.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component allows a remote, unauthenticated attacker (CVSS vector PR:N) to elevate privileges inside the browser after convincing a victim to visit an attacker-controlled or compromised page (UI:R), affecting Firefox builds before 157 and ESR branches before 153.4 and 140.17. The 8.8 score derives from high confidentiality, integrity, and availability impact with low attack complexity, but scope is unchanged (S:U), meaning the impact stays confined to the browser's own privilege boundary rather than escaping to the host operating system. There is no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no, so practical exposure is driven by how quickly the supplied ESR/rapid-release fixes are deployed rather than by observed attack activity.
A race condition in Mozilla Firefox's Audio/Video component can culminate in a use-after-free, potentially allowing memory corruption when a victim loads attacker-controlled media content in any Firefox build prior to version 157. Exploitation is unauthenticated over the network but demands both user interaction (the victim must visit or interact with a crafted page) and a precisely won, non-deterministic timing window between concurrent media-processing operations, which makes the bug high-complexity and not automatable (SSVC Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Firefox 157 as the fix per advisory mfsa2026-97.
Use-after-free in Mozilla Firefox's Preferences: Backend component before version 157 enables a sandbox escape, allowing attacker-controlled web content to break out of the browser's renderer sandbox and gain code execution with browser privileges; exploitation requires the victim to load attacker-controlled content (UI:R) with no authentication or special privileges (PR:N), and default configurations are affected. Mozilla addressed this in Firefox 157 via the mfsa2026-97 advisory, and while the CVSS 9.6/S:C scoring reflects a genuinely high-severity memory-corruption issue, no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Same-origin policy bypass in Mozilla Firefox's WebExtensions component lets attacker-controlled web content defeat origin isolation and access cross-origin data, producing high confidentiality and integrity impact without availability loss. Exploitation requires a victim running an affected build (prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42) to visit or interact with attacker-controlled content - the CVSS UI:R prerequisite - while no authentication or prior privileges are needed on the attacker side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1); default configurations are affected because the flaw sits in a core browser component. No public exploit code has been identified at time of analysis, EPSS is low at 0.17% (5th percentile), and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is currently a patch-now hardening issue rather than an actively exploited one.
Privilege escalation in the DLL Services component of Mozilla Firefox allows an attacker to achieve elevated code execution - with high confidentiality, integrity, and availability impact - when a victim renders attacker-controlled web content, reflected in a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication is required (PR:N) and attack complexity is low, but the vector mandates user interaction (UI:R), meaning a target must be induced to load a crafted page rather than being compromised by a service-side drive-by. The issue is fixed in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17, so unpatched pre-157 and pre-ESR builds are the exposed population; there is no public exploit code and no observed exploitation at time of analysis, and SSVC classifies the flaw as non-automatable.
Sandbox escape in Mozilla Firefox allows remote attackers to break out of the content sandbox by exploiting a use-after-free in the browser's Disability Access (accessibility) APIs. Affected are Firefox versions before 157 and Firefox ESR versions before 153.4; the attack is network-delivered and requires no authentication, but is not zero-click - the victim must open attacker-controlled web content that exercises the accessibility APIs and win the use-after-free race (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Mozilla has fixed the flaw in Firefox 157 and Firefox ESR 153.4, and no public exploit has been identified at time of analysis; the score reflects the high confidentiality, integrity, and availability impact combined with scope change once the sandbox boundary is crossed, while the UI:R component keeps it from being self-propagating.
Storage data exposure in Mozilla Firefox stems from cryptography misuse in the Storage: Quota Manager component, allowing remote, unauthenticated attackers to trigger information disclosure if a victim loads attacker-controlled web content (UI:R, PR:N). The independent assessment rates confidentiality impact High and integrity impact Low (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), with affected versions being Firefox before 157 and Firefox ESR before 153.4. No public exploit was identified at time of analysis, and EPSS is low at 0.15% (4th percentile), so this is a moderate-priority patching item rather than an urgent, actively exploited issue.
Use-after-free in Mozilla Firefox's Graphics: WebRender compositor lets remote, unauthenticated attackers corrupt memory and escalate privileges inside the browser when a victim loads attacker-controlled web content - no authentication is required (PR:N), but the attack is not server-side passive and depends on the target visiting or interacting with a malicious or compromised page (UI:R). The flaw rates CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was fixed in Firefox 157 and in Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but not urgent priority. Modern Firefox content-process sandboxing further limits post-corruption impact unless the attacker chains a separate sandbox escape, and WebRender is enabled by default, so no unusual configuration is needed to reach the vulnerable path.
Use-after-free in Mozilla Firefox's WebAssembly engine (JavaScript/SpiderMonkey component) allows an unauthenticated remote attacker to corrupt browser memory and potentially achieve code execution against users running Firefox versions prior to 157. Exploitation requires the victim to open attacker-controlled web content that exercises a crafted WebAssembly module (UI:R), and while no public exploit code has been identified at time of analysis and the issue is not on CISA KEV, the CVSS 3.1 base score of 8.8 with C:H/I:H/A:H reflects a full high-impact memory-corruption outcome typical of an RCE-class heap use-after-free. Users on Firefox 157 or later are not affected.
Mozilla Firefox's Internationalization component contains incorrect boundary conditions that permit a sandbox escape, allowing an attacker who already has code execution inside the content process to break out of the browser sandbox. The flaw affects Firefox before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; exploitation requires a victim to load attacker-controlled web content (UI:R) and typically must be chained with a separate content-process memory-corruption vulnerability because this is not a direct remote code execution flaw. No public exploit code has been identified at the time of analysis, and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity despite the critical CVSS score of 9.6.
JIT miscompilation in Firefox's WebAssembly engine allows crafted WebAssembly delivered through attacker-controlled web content to corrupt in-process memory via a type confusion (CWE-843), producing high confidentiality impact and limited integrity impact but no availability impact. The flaw is remotely reachable at low complexity and unauthenticated (AV:N/AC:L/PR:N) but is gated by user interaction (UI:R) - the victim must load a malicious page that exercises the vulnerable JIT path - and by the content-process sandbox, so on its own it yields in-process memory disclosure rather than host compromise, which would require chaining a separate sandbox-escape bug. Mozilla has fixed it in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17; EPSS is only 0.16% (4th percentile) and no public exploit or CISA KEV entry was identified at time of analysis.
Use-after-free in the DOM: Core & HTML engine of Mozilla Firefox allows memory corruption that can be driven by attacker-controlled web content, potentially yielding code execution or memory disclosure inside the browser's content process. Affected are Firefox releases before 157 and the ESR branches before 153.4, 140.17, and 115.42; exploitation only requires that the victim load a malicious or compromised page (UI:R) with no authentication and no non-default settings, since the DOM Core/HTML code path is always active. Mozilla has published fixed versions and no public exploit was identified at time of analysis, and the achievable impact is bounded by Firefox's content-process sandbox unless chained with a separate escape.
Use-after-free in Mozilla Firefox's XSLT engine lets a remote, unauthenticated attacker corrupt memory by getting a victim to render attacker-controlled content that performs an XSL transformation, with the assessed CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflecting high confidentiality, integrity, and availability impact. The flaw affects Firefox builds before 157 and ESR builds before 153.4, 140.17, and 115.42, and is remediated in those releases. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); the main practical barrier is the mandatory user interaction, since the victim must visit or render the malicious content for the XSLT path to execute.
Use-after-free in Mozilla Firefox's Graphics: Canvas2D rendering component allows a remote, unauthenticated attacker to corrupt browser memory and potentially achieve arbitrary code execution when a victim loads crafted web content in an unpatched build. Exploitation hinges on user interaction - the victim must open a malicious or compromised page that exercises the Canvas2D path - and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects high confidentiality, integrity, and availability impact confined to the browser process by the renderer sandbox. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), making this a serious client-side bug rather than an emergency; vendor-released fixes are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.
Memory corruption in Mozilla Firefox's JavaScript and WebAssembly engine (CWE-824, access of uninitialized pointer) allows a crafted or compromised web page to trigger an invalid-pointer dereference in the browser's content process, potentially resulting in information disclosure or code execution within that process. Exploitation requires the victim to navigate to attacker-controlled content in a pre-patch build - Firefox before 157, Firefox ESR before 153.4, or Firefox ESR before 140.17 - and is unauthenticated per the assessed CVSS vector (AV:N/PR:N), although the vendor's 9.8 score assumes no user interaction while our independent assessment requires UI:R, so the effective risk should be reconciled before treating this as an emergency. No public exploit code has been identified at time of analysis (no KEV listing, no POC) and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity.
A sandbox escape in Firefox's XUL component allows attacker-controlled content to break out of the browser's security boundary and gain the privileges of the parent process, resulting in high confidentiality and integrity impact with changed scope (CVSS 9.6). Exploitation requires the victim to load or interact with attacker-controlled content (UI:R), but no credentials are needed (PR:N), and default Firefox configurations are affected; SSVC rates the issue non-automatable, so mass-scanning-style campaigns are unlikely. The flaw is fixed in Firefox 157 and Firefox ESR 153.4, no public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low (0.15%, 4th percentile).
Use-after-free memory corruption in Mozilla Firefox's Graphics component can be exploited by a remote, unauthenticated attacker to escape the browser's content sandbox and run code at the privilege of the parent/broker process, provided the victim renders attacker-controlled content. The only prerequisite is user interaction - visiting or rendering a crafted page in any unpatched build (Firefox before 157, ESR before 153.4, ESR 140.17, ESR 115.42) - since graphics rendering is enabled by default and no credentials are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6). No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the independent assessment notes that reliable heap grooming of the use-after-free is non-trivial, making this a high-priority RCE-class flaw rather than a demonstrated weaponized one.
Memory corruption in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger a use-after-free when a victim loads attacker-controlled web content, potentially leading to arbitrary code execution, information disclosure, or crashes. Affected versions include Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42; the flaw is patched in those fixed releases. Exploitation requires user interaction in default browsing and must contend with Firefox sandboxing and heap-hardening mitigations; no public exploit identified at time of analysis (no CISA KEV confirmation).
A use-after-free in Firefox's Layout: Text and Fonts component lets remote attackers corrupt memory by enticing a victim to open crafted web content, potentially leading to code execution within the browser's content process. Unauthenticated network attackers can trigger it with low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) confirms a successful attack requires user interaction and no privilege is needed beforehand. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; there is no CISA KEV entry and no public exploit identified at time of analysis, though the memory-corruption class makes weaponization plausible.
Boundary-condition errors in Mozilla Firefox's Graphics component allow an unauthenticated remote attacker to trigger memory corruption and achieve privilege escalation on the affected platform, provided the victim loads attacker-controlled content that reaches the vulnerable rendering code path. Only builds below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 are affected - updating to any of those versions fully remediates the issue. Although the CVSS base score is 8.8 with high confidentiality, integrity, and availability impact, no public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable, and the mandatory user-interaction requirement (UI:R) prevents automated or wormable spread, making this a genuine but not top-priority issue.
A sandbox escape in Mozilla Firefox's Graphics: WebRender component lets attacker-controlled web content break out of the browser's content-process sandbox and reach the parent/broker process, with a 9.6 CVSS score driven by scope change plus high confidentiality, integrity and availability impact. Successfully triggering it requires an unpatched build and mandatory user interaction (PR:N, UI:R) - the victim must load or render a malicious page that exercises the WebRender path - and because the flaw sits in the rendering/sandbox boundary rather than in a directly reachable network service, realistic abuse typically depends on chaining it with a separate content-process compromise, which is consistent with SSVC rating Exploitation 'none' and Automatable 'no'. Fixed builds are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42; there is currently no public exploit identified at time of analysis and EPSS is low at 0.16% (4th percentile), so exploitation signals are sharply split between the very high severity rating and the low likelihood evidence.
A use-after-free flaw in Firefox's DOM Core & HTML component (CWE-416) can corrupt browser memory when a victim loads attacker-controlled web content, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All supported release channels are affected below the fixed builds - Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 - and the flaw is exploitable by unauthenticated remote attackers only if the user actively visits or is induced to load a malicious page (UI:R), with no server-side exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact ranges from information disclosure and memory corruption to a potentially exploitable crash or code execution, though reliable exploitation requires winning the heap reallocation race and defeating browser sandbox mitigations, placing it in the normal severity band for this bug class rather than an emergency.
A use-after-free in Mozilla Firefox's XSLT (XML stylesheet transformation) engine can be triggered when a victim loads attacker-controlled content that exercises stylesheet processing, allowing memory corruption that jeopardizes confidentiality, integrity, and availability of the browser session. The flaw affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires no privileges (PR:N) but does require user interaction (UI:R) - the target must open a malicious page or XML document, with no zero-click or server-side path indicated by the available data. Mozilla has released fixed versions across all supported release and ESR channels; no public exploit code was identified at time of analysis.
Use-after-free in Mozilla Firefox's DOM Core & HTML engine allows attacker-controlled web content to corrupt memory and escape the browser's content sandbox, potentially yielding code execution at higher privilege on the host. Affected are Firefox builds prior to 157 and ESR branches prior to 153.4, 140.17, and 115.42; the flaw is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), so no authentication or non-default configuration is required, but a victim must load or render a malicious page (UI:R). No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited, though the scope-changed rating reflects that a successful trigger crosses a security boundary rather than merely crashing a content process.
Use-after-free in the Graphics: Canvas2D component of Mozilla Firefox allows remote, unauthenticated attackers to corrupt browser memory when a victim renders attacker-controlled web content - a malicious page, ad, or iframe provides the required user interaction (UI:R). Successful exploitation can expose or modify memory (high C/I/A impact per the 8.8 CVSS), causing crashes and potentially arbitrary code execution inside the content/renderer process, although turning the primitive into reliable code execution also requires defeating Firefox's site isolation, sandbox, and ASLR hardening, which keeps practical difficulty above the raw score. Only unpatched builds are affected; Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42 carry the fix, and no public exploit code or active exploitation was identified at the time of analysis.
A use-after-free in Mozilla Firefox's WebAssembly component allows remote attackers to potentially execute arbitrary code by enticing a victim to visit a malicious web page. The vulnerability affects Firefox versions before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; no authentication or non-default configuration is required, but exploitation requires user interaction (UI:R). No public exploit code or active exploitation has been identified at time of analysis, and browser process sandboxing limits the impact.
Sandbox escape in Mozilla Firefox's Graphics component allows unauthenticated remote attackers to break out of the browser's content sandbox when a victim renders attacker-controlled web content (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C, score 9.6). Affected builds are Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42, all of which now have vendor fixes available across their respective release trains. Exploitation requires chaining the escape with a separate content-process compromise to achieve code execution, which is consistent with CISA SSVC's 'Automatable: no' and 'Exploitation: none' ratings; EPSS is low at 0.16% (4th percentile) and no public exploit code has been identified at time of analysis.
Use-after-free in Mozilla Firefox's DOM: Core & HTML implementation lets remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content in an unpatched build. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is network-reachable and low-complexity and requires no authentication, but does depend on user interaction - the victim must open a malicious or compromised page. Every supported channel is affected prior to the fixed releases (Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42); there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though successful heap grooming of the freed DOM object can escalate beyond a crash within the constraints of Firefox's sandbox and mitigations.
Use-after-free in Mozilla Firefox's IndexedDB storage implementation allows a remote, unauthenticated attacker to execute arbitrary code with the victim's privileges by convincing them to load attacker-controlled web content that exercises the IndexedDB API. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact, with the only meaningful barrier being the required user interaction - no authentication or non-default configuration is needed. Mozilla fixed the flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; no public exploit code or confirmed active exploitation was identified at time of analysis, but given Firefox's enormous install base and the browser-context code execution primitive, this warrants priority patching rather than emergency escalation.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component (CWE-416) lets remote attackers achieve full confidentiality and integrity impact against unpatched Firefox builds when a victim simply loads attacker-controlled web content, matching the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Firefox versions prior to 157, Firefox ESR prior to 153.4, and Firefox ESR prior to 140.17; exploitation needs no authentication or non-default configuration, and the mandatory browsing/user interaction is the primary limiting factor. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but Mozilla has shipped fixed builds, so prioritization should focus on unpatched endpoints in browser-exposed or high-value user populations.
Undefined behavior in the DOM Streams component of Mozilla Firefox allows remote, unauthenticated attackers to trigger memory-safety-class corruption in the browser process when a victim loads attacker-controlled web content, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R). The flaw affects builds prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, and requires user interaction - the victim must open a crafted page that exercises the vulnerable Streams API path - but no authentication or non-default browser configuration is needed. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue; EPSS is very low at 0.16% (4th percentile), though the underlying CWE-758 memory-safety class means reliable weaponization would require substantial exploit-development effort rather than being trivially scriptable.
Mozilla Firefox can be driven to escape its content sandbox through a use-after-free in the DOM Content Processes component, letting a remote, unauthenticated attacker who convinces a victim to load a crafted page (UI:R, PR:N) corrupt memory in the sandboxed content process and cross into the more privileged parent process - the pivot reflected in the CVSS 9.6 scope-change rating and the C:H/I:H/A:H metrics. The flaw affects Firefox before 157 and the ESR trains before 153.4, 140.17 and 115.42, and it is fixed in those exact builds. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly component lets remote attackers corrupt memory and potentially achieve code execution or disclose sensitive data when a user loads attacker-controlled web content containing a malicious WebAssembly payload. The flaw affects default Firefox configurations up to Firefox 157 and the ESR branches-Firefox ESR 153.4 and Firefox ESR 140.17 are the first fixed releases-and requires no authentication, only that the victim browse a crafted page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a genuine but not top-tier priority; exploitation is client-side and requires user interaction, and because scope is unchanged the initial impact is confined to the content process unless chained with a separate sandbox-escape bug.
Use-after-free in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to corrupt memory and potentially achieve code execution or read sensitive data when a victim loads attacker-controlled web content that exercises the WebGPU API; the flaw is fixed in Firefox 157. Exploitation is gated by user interaction (CVSS PR:N, UI:R) and by WebGPU being reachable in the victim's build, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The 8.8 CVSS score reflects high confidentiality and integrity impact within the affected browsing process, though the content-process sandbox typically limits standalone impact unless chained with a sandbox escape.
Mozilla Firefox builds prior to version 157, along with the ESR branches prior to 153.4, 140.17, and 115.42, contain a use-after-free in the Networking: Cache component that lets a remote attacker corrupt memory by persuading a victim to render attacker-controlled web content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is the classic browser drive-by profile: no authentication is required, complexity is low, but exploitation depends on the user navigating to or loading a malicious page that reaches the specific cache code path, and the content-process sandbox limits how far a single use-after-free can be pushed toward full system compromise. The flaw is patched in Firefox 157 and Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no CISA KEV listing and no public exploit code were identified at time of analysis, so this is a patch-now, high-severity memory-safety bug rather than a confirmed actively exploited one.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine enables remote code execution or memory corruption when a victim views a malicious webpage, requiring only that the user loads attacker-controlled content (UI:R) with no authentication (PR:N). The flaw affects all Firefox versions prior to 157 and Firefox ESR prior to 153.4, and is rated CVSS 8.8 due to high confidentiality, integrity, and availability impact; the content-process sandbox (S:U) limits impact to the browser process absent a separate escape. No public exploit identified at time of analysis, and no CISA KEV listing; Mozilla has released patches in Firefox 157 and Firefox ESR 153.4.
Privilege escalation in Mozilla Firefox versions prior to 157 arises from incorrect boundary conditions in the Graphics: WebGPU component, a CWE-119 buffer-bounds flaw that a remote, unauthenticated attacker can trigger when a victim loads attacker-controlled web content. Exploitation depends on user interaction (UI:R) - typically visiting a malicious or compromised page - and is rated CVSS 8.8 with high confidentiality, integrity and availability impact, though scope is unchanged (S:U) so the effect is confined to Firefox's content process rather than the host operating system. No public exploit code was identified and CISA's SSVC assessment records Exploitation: none, so this is a mid-to-high priority browser patch rather than an emergency; the issue is fixed in Firefox 157.
Memory corruption in Mozilla Firefox's WebGPU graphics component (versions prior to 157) can be triggered when a user loads attacker-controlled web content that drives the vulnerable rendering path, yielding a buffer overflow with high confidentiality and availability impact. The flaw is remote, requires no authentication, and exploitation depends on the victim rendering a malicious page, so practical attacks rely on phishing, malvertising, or a compromised site rather than zero-click delivery. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.15% (4th percentile), though the vendor's 9.1 CVSS rating and a patch in Firefox 157 indicate a serious memory-safety defect that should be prioritized for browser fleet updates.
A use-after-free in Firefox's DOM Content Processes component lets unauthenticated remote attackers escape the content-process sandbox by getting a victim to render attacker-controlled web content, resulting in high confidentiality, integrity and availability impact across a changed security scope (CVSS 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The mandatory user interaction (loading or rendering the malicious page) is the primary limiting factor, and no authentication or elevated privileges are required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42, so patched or auto-updated installations are unaffected.
A use-after-free in Mozilla Firefox's Graphics: WebGPU component (CWE-416) lets a remote attacker who gets a victim to render attacker-controlled web content corrupt memory and potentially achieve code execution in the browser's process, earning a High-severity CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All Firefox builds prior to 157 are affected, and Mozilla fixed the issue in Firefox 157 (advisory mfsa2026-97, Bugzilla 2059020). No public exploit code or confirmed active exploitation has been identified at time of analysis, and because the vector requires user interaction, mass automated exploitation is unlikely, though per-target heap grooming is needed for reliable execution.
Sandbox escape in Mozilla Firefox's Security: Process Sandboxing component allows an attacker to break out of the browser's content-process sandbox when a victim loads attacker-controlled web content, yielding full confidentiality, integrity, and availability impact on the host. The flaw is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), unauthenticated (PR:N) but requiring user interaction (UI:R), and affects Firefox versions prior to ESR 153.4 and Firefox 157. EPSS is low at 0.15% (4th percentile) and no public exploit code has been identified at time of analysis, though CISA SSVC assigns total technical impact with no known exploitation.
Uninitialized memory handling in Mozilla Firefox's Storage Quota Manager can leak contents of the browser's process memory to a remote attacker who persuades a victim to load attacker-controlled web content, affecting Firefox releases before 157 as well as ESR builds before 153.4, 140.17, and 115.42. The required user interaction (UI:R) is the main limiting factor, and no privileges are needed (PR:N); the independently assessed impact is confidentiality disclosure only, with no code execution or availability effect established, and triage should not treat the published I:H/A:N components of the 8.1 CVSS score as realized. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), with vendor-supplied fixes already available in Firefox 157 and the three ESR branches.
Sandbox escape in Mozilla Firefox's DOM Navigation component (CVE-2026-100758, CVSS 9.6) lets attacker-controlled web content escape the content-process sandbox and reach high-integrity resources on the host once a user loads a malicious or compromised page, ad, or embedded frame. The flaw requires no authentication or special privileges but does require the victim to visit the attacker's content (UI:R), and because the escape changes security scope (S:C) with high confidentiality, integrity, and availability impact, every pre-fix Firefox build - including the legacy ESR 115 branch - is exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Mozilla shipped fixes in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, so risk is concentrated in unpatched installs and in organizations that lag on ESR updates.
Use-after-free (CWE-416) in Mozilla Firefox's Widget component allows remote attackers to potentially execute arbitrary code when a victim renders attacker-controlled web content in unpatched versions (before Firefox 157, Firefox ESR 153.4, ESR 140.17, or ESR 115.42). Successful exploitation requires reliable heap manipulation and depends on the user opening malicious content (UI:R), but can achieve high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Memory-corruption flaws in Firefox's Audio/Video Playback component (CWE-119) can be triggered when a user loads attacker-controlled audio or video content, potentially leading to high-integrity and high-confidentiality compromise of the browser process. The issue affects Firefox builds prior to 157 and the ESR branches prior to 153.4, 140.17, and 115.42, is rated CVSS 3.1 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), and requires user interaction - the victim must visit a malicious page or open crafted media that reaches the playback stack. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.
An out-of-bounds read in Mozilla Thunderbird's IMAP response parser affects all builds prior to Thunderbird 156 and prior to Thunderbird 140.16 (ESR), allowing a malicious or compromised IMAP server to crash the mail client and potentially expose a limited amount of process memory by sending a crafted untagged '* ID' response. The flaw is reachable before authentication (CVSS vector PR:N/UI:N), so an attacker needs no mailbox credentials and no user click beyond the client connecting to a server they control, have compromised, or can intercept via man-in-the-middle; independent assessment sets confidentiality impact to Low and availability impact to High, which is milder than the 9.1 NVD base score. Exploitation requires the victim's Thunderbird to actually initiate an IMAP session to the attacker-controlled endpoint, and with EPSS at only 0.21% (12th percentile) and no CISA KEV entry or public exploit code identified, the severity signals conflict: a critical-looking base score against low real-world exploitation likelihood, mitigated by the availability of fixed builds in Thunderbird 156 and 140.16.
An out-of-bounds read in Mozilla Thunderbird's IMAP response parsing can disclose process memory or crash the client when the mail client connects to an attacker-controlled or compromised IMAP server, or when an on-path attacker injects crafted IMAP lines into a session. The flaw affects Thunderbird versions before 156 and Thunderbird ESR versions before 140.16, and is fixed in those releases; exploitation requires the victim's client to establish an IMAP session with the malicious endpoint (CVSS UI:R) while requiring no attacker authentication (PR:N). EPSS is 0.18% (8th percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Malformed email headers in Mozilla Thunderbird before 156 and 140.16 ESR can cause header parsing confusion or potential memory safety violations when a victim opens a crafted message, though code execution is only described as a potential outcome by the vendor. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.18% (percentile 8). The vulnerability requires user interaction (UI:R) because the victim must receive and render the malicious email, and the raw CVSS of 9.8 overstates real-world urgency for a desktop mail client.
Widget: Win32 mitigation bypass in Mozilla Firefox on Windows allows attacker-controlled web content to defeat a platform security protection (CWE-693); the flaw is fixed in Firefox 156 and Firefox ESR 153.3. Mozilla rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), implying unauthenticated remote compromise with no user interaction, but the independent assessment scores it AV:N/AC:H/PR:N/UI:R - a Windows-only precondition, a victim who actually renders the malicious page, and typically a second chained vulnerability are required before the bypass converts into high confidentiality/integrity impact. EPSS is 0.15% (5th percentile), and there is no CISA KEV entry or public exploit code identified at the time of analysis, so real-world exploitation pressure is currently low.
Improper authentication in the SAML SSO identity-linking flow of self-hosted Sentry 26.5.0 through 26.7.1 lets an attacker who controls a SAML identity provider trick an already-authenticated user into opening a crafted URL, link the attacker's federated identity to that user's Sentry account, and achieve full account takeover (CVSS 4.0 base 7.6, High; independent assessment CVSS 3.1 7.6 with C:H/I:H). Exploitation is constrained by two prerequisites: the victim's browser must accept the cross-site cookie context (Firefox sending SameSite=None cookies, or Chromium with third-party cookies explicitly enabled, which is not the Chromium default), and the target deployment must have SAML SSO configured, so the realistically reachable population is narrower than the raw score suggests. Sentry SaaS was remediated on July 27, 2026 and is not affected; self-hosted instances are fixed in 26.7.2, and no public exploit code was identified at time of analysis.
Privilege escalation in Mozilla Firefox's WebExtensions component allows remote attackers to reach high confidentiality, integrity, and availability impact inside the browser's privileged context, provided the victim performs an interaction such as visiting attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8). Unauthenticated attackers can reach the flaw over the network against default installations, but the required user interaction rules out a zero-click drive-by path. All Firefox builds before 158 and Firefox ESR builds before 153.5 are affected; upgrading to 158 or ESR 153.5 removes the condition. There is no public exploit identified at time of analysis and CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', making this a genuine high-priority patch item rather than an emergency.
Sandbox escape in Mozilla Firefox allows attacker-controlled web content to break out of the browser's content sandbox by winning a timing-dependent race condition in the Networking component (CWE-362), rated CVSS 8.3 with scope change (S:C), meaning compromise extends beyond the sandboxed process. Exploitation is unauthenticated (PR:N) and remote (AV:N) but requires the victim to load attacker-controlled web content (UI:R) and is unreliable per attempt due to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.16% (5th percentile); the vulnerability is fixed in Firefox 158 and Firefox ESR 153.5.
Privilege escalation in the DOM: Navigation component of Mozilla Firefox (prior to 158) and Firefox ESR (prior to 153.5) lets an unauthenticated attacker gain elevated privileges inside the browser when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-269). The sole gate on exploitation is user interaction (UI:R, PR:N): the victim simply has to render a hostile or compromised page in an unpatched build, with no authentication, special configuration, or local access required. No public exploit code has been identified at time of analysis, and CISA's SSVC triage records exploitation as "none" with technical impact "total" and automatable as "no"; combined with the absence of KEV listing and EPSS data, this reads as a genuinely high-severity but not yet demonstrably exploited issue whose urgency depends on future exploit development. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and upgrading fully removes the exposure.
A sandbox escape in Mozilla Firefox's DOM Content Processes component lets a remote, unauthenticated attacker break out of the content-process sandbox if a victim merely renders attacker-controlled web content in any Firefox build prior to 158 (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the score is scope-changed, a successful escape grants impact outside the sandboxed content process - high confidentiality, integrity and availability effects on the host rather than on the page alone - but in practice the escape generally has to be paired with a separate content-process code-execution flaw to convert the boundary crossing into full code execution. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.19% (8th percentile), and the mandatory user interaction of loading the malicious page is the main practical constraint on real-world exploitation.
Privilege escalation in Mozilla Firefox's Panning and Zooming component lets an attacker who gets a target to render crafted content cross a privilege boundary inside the browser, with high impact to confidentiality, integrity and availability (CVSS 8.8). Affected builds are Firefox before 158 and Firefox ESR before 153.5, which Mozilla fixed via advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile), but the input vector and our independent assessment disagree on the exploit preconditions (PR:L/UI:N versus PR:N/UI:R), so reconcile those signals before prioritization; authentication requirements are not confirmed from available data.
Privilege escalation in Mozilla Firefox's WebExtensions component allows an extension-level actor to gain capabilities beyond those it was granted, yielding high confidentiality and integrity impact; all Firefox builds prior to version 158 are affected, with the fix delivered in Firefox 158 via Mozilla security advisories mfsa2026-106 and mfsa2026-109. Exploitation requires a low-privileged foothold - in practice an already-installed malicious or compromised browser extension reaching the vulnerable privilege-management code path (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) - and no public exploit code has been identified at time of analysis. EPSS is low at 0.16% (4th percentile) and the flaw is not listed in CISA KEV; signals are mixed and point to a moderate, not emergency, priority, with the AV:N rating questionable for an extension-context escalation and worth verifying with Mozilla.
Privilege escalation and information disclosure in Mozilla's Process Sandboxing component let attacker-controlled web content break out of the Firefox content-process sandbox on unpatched installations - Firefox before 158 and Firefox ESR before 153.5 - with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is remote and requires no attacker authentication, but it is user-driven: the victim must actively load the malicious page, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a targeted client-side risk rather than a mass-exploitation candidate. There is no public exploit identified at time of analysis, and vendor-released fixes ship in Firefox 158 and Firefox ESR 153.5 (MFSA 2026-106 and MFSA 2026-108).
A sandbox escape in Mozilla Firefox's Networking component allows unauthenticated remote attackers to break out of the browser's security sandbox and potentially execute code on the host when a victim loads attacker-controlled web content. The vulnerability stems from incorrect boundary conditions (CWE-119) and carries a CVSS score of 9.6, though exploitation requires user interaction (UI:R) and the sandbox escape alone must be chained with a separate content-process code-execution primitive for full host compromise. No public exploit code has been identified, and the EPSS score is low at 0.19% (8th percentile); patched versions are Firefox 158 and Firefox ESR 153.5.
A use-after-free in Mozilla Firefox's Networking component can be escalated into a sandbox escape, meaning a malicious page can corrupt freed memory and break out of the browser's content-process sandbox to reach higher-privileged code. Affected are Firefox builds prior to 158 and Firefox ESR builds prior to 153.5; no authentication is required, but exploitation depends on the victim navigating to attacker-controlled web content (UI:R), consistent with the assessed CVSS:3.1 vector of 9.6 and the SSVC 'not automatable' rating. Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5; at time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed in-the-wild activity.
Sandbox escape and site-isolation bypass in Mozilla Firefox allow unauthenticated remote attackers to break the browser's security boundary by triggering a use-after-free in the Networking component. Affected are Firefox versions before 158 and Firefox ESR before 153.5; exploitation requires the victim to load attacker-controlled web content, meaning no autonomous trigger exists. No public exploit identified at time of analysis, though the 9.6 CVSS score and total technical impact warrant urgent patching.
Privilege escalation in Mozilla Firefox's Application Update component allows a locally present, low-privileged attacker to elevate their privileges on the affected host, with the input CVSS 3.1 score of 8.8 (High) reflecting complete confidentiality, integrity, and availability impact. Exploitation requires only low privileges with no user interaction and is limited to unpatched builds prior to Firefox 158 and Firefox ESR 153.5; systems updated to those versions are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) signal, with the EPSS score remaining low at 0.19% (8th percentile).
Memory corruption in Mozilla Firefox's Layout engine lets a remote, unauthenticated attacker who convinces a victim to render attacker-controlled web content corrupt memory, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicating high confidentiality and integrity impact and a full availability impact on the client. All Firefox builds prior to 158 are affected, along with Firefox ESR releases prior to 115.43 and 153.5. Exploitation hinges entirely on user interaction - the victim must navigate to or render a hostile page - and no public exploit or active exploitation has been identified at time of analysis; EPSS is low at 0.16% (5th percentile), and vendor-released fixes (Firefox 158, ESR 115.43, ESR 153.5) are available per Mozilla advisories mfsa2026-106 through mfsa2026-110.
A type-confusion miscompilation in Mozilla Firefox's JavaScript JIT engine (CWE-843) lets remote attackers corrupt memory and potentially read or modify data inside the browser process when a user loads attacker-controlled JavaScript. Exploitation is unauthenticated over the network (PR:N) but requires user interaction (UI:R) - the victim must visit or render hostile content with JavaScript enabled on an unpatched build. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; no public exploit code or confirmed active exploitation has been identified, and the EPSS score is low at 0.16% (5th percentile), making this a serious but not emergency-tier browser flaw.
Integer overflow in Mozilla Firefox's Graphics component (CWE-190) can lead to memory corruption and potential remote code execution when a user loads a malicious web page. Affected versions are prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; exploitation requires user interaction (UI:R) and no authentication. No public exploit code has been identified, and the EPSS score is low at 0.16% (5th percentile), though the vulnerability is rated high severity (CVSS 8.8).
JIT miscompilation in Mozilla Firefox's JavaScript engine can cause the browser to generate incorrect native code for attacker-supplied scripts, giving a malicious page high confidentiality and integrity impact within the affected browsing context. The flaw affects Firefox builds prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5; exploitation is remote and requires no credentials (PR:N) but is gated by user interaction, since the victim must load attacker-controlled web content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1). No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), but vendor-released patches exist in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Mozilla Firefox releases prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5 contain incorrect boundary conditions in the JavaScript engine that let remote attackers corrupt or disclose memory when a user loads attacker-controlled web content. Because the weakness sits in script processing, no credentials or pre-existing privileges are needed - but exploitation is not unattended: the victim must actively browse to a malicious or compromised page with JavaScript enabled (the default), and the vendor rates availability impact as none, so the realistic outcome is memory disclosure/integrity corruption rather than a guaranteed crash or confirmed remote code execution. Publicly available exploit code has not been observed and there is no public exploit identified at time of analysis; CISA KEV does not list this CVE, and EPSS is only 0.16% (4th percentile), so this is a genuine patch-promptly issue rather than an emergency one.
Memory corruption in Mozilla Firefox's JavaScript engine can be triggered when a remote unauthenticated attacker convinces a user to load attacker-controlled JavaScript content, yielding high confidentiality and integrity impact with no availability impact. This is not a zero-click attack; exploitation requires user interaction (UI:R) to render a malicious page, so it depends on social engineering, malvertising, or a compromised site. Mozilla fixed the issue in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; at time of analysis there is no public exploit identified, and EPSS is very low at 0.16% (4th percentile), indicating a genuine but not emergency-level risk.
Sandbox escape in the Mozilla Firefox Graphics component allows an attacker who can get a victim to render attacker-controlled web content to break out of the browser's content-process sandbox, with Low-rated confidentiality, integrity and availability impact but a changed security scope. Affected are unpatched Firefox builds below 158 and ESR builds below 115.43 and 153.5; no authentication is required, but exploitation is gated by mandatory user interaction (UI:R) such as visiting a crafted page, which precludes zero-click mass exploitation. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), making this a moderate-severity but low-priority issue in practice; vendor-released patches are available.
Firefox for iOS versions prior to 157.1 interpolate a page's HTML lang attribute directly into the browser's translation JavaScript, so crafted markup in that attribute executes as code inside Firefox's privileged content world and escapes the page's Content Security Policy - a scope-changing outcome in the independent assessment. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: the victim must open an attacker-controlled or compromised page and cause the page-translation feature to process it, and CISA's SSVC rates the flaw as not automatable. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the vendor fixed it in Firefox for iOS 157.1, so the practical priority is prompt upgrade rather than emergency response.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Mitigation bypass in Mozilla Firefox's File Handling component affects Firefox builds prior to 157.0.1 and lets an attacker defeat a protection mechanism that Firefox relies on when a user opens, downloads, or otherwise processes an attacker-supplied file. The input CVSS 3.1 vector rates this 9.8 CRITICAL, but the supporting evidence contradicts that: the vulnerability is a CWE-693 protection-mechanism failure whose practical impact depends on chaining it with a second attack rather than achieving standalone compromise, it is client-side and requires user interaction with malicious content, and the independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Exploitation is unauthenticated per the vector (PR:N), exploitation is not automatable against a server, EPSS is a low 0.14% (3rd percentile), SSVC records Exploitation: none, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. A vendor patch is available in Firefox 157.0.1, so patched users are not exposed.
Unauthenticated remote code execution affects Taskcluster deployments running versions prior to 100.3.0 that expose the GraphQL endpoint to an anonymous role. The vulnerable code path is the GraphQL `filter: JSON` argument on list/search queries (clients, roles, secrets, worker pools, denylist addresses, artifacts, hooks, namespaces), which was parsed with the `sift` library using improper input validation (CWE-20); a crafted filter payload can lead to code execution on the web-server, giving full confidentiality, integrity, and availability impact (assessed CVSS 3.1 9.8, raw vendor CVSS 4.0 8.7). Exploitation is network-reachable and needs no authentication or user interaction, but is conditional on the deployment granting an anonymous role access to GraphQL; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the vendor-released patch is version 100.3.0.
Memory corruption in Mozilla Firefox ESR's Graphics: Canvas2D component allows remote attackers to execute code within the browser content process when a victim is induced to load attacker-controlled web content; the root cause is a use-after-free (CWE-416) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability loss inside the exploited process. Affected builds are ESR 115.x before 115.42, ESR 140.x before 140.17, and ESR 153.x before 153.4, with vendor fixes released in Firefox ESR 115.42, 140.17, and 153.4. Exploitation requires victim interaction (loading a malicious or compromised page) and is unauthenticated over the network (PR:N); no public exploit code was identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with 'no' automatable applicability and total technical impact.
Use-after-free in Mozilla Firefox's DOM UI Events and Focus Handling code allows a remote, unauthenticated attacker to corrupt the browser's heap and potentially achieve code execution in the content process when a victim loads attacker-controlled web content. The flaw affects Firefox builds before 157 and Firefox ESR before 153.4, where it has been fixed; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction (opening the page) being the primary precondition, and CISA's SSVC assessment does not consider it automatable. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so despite the high base score this reads as a medium-priority memory-corruption flaw in an ubiquitous browser rather than an emergency, actively exploited issue.
Origin-separation mitigation bypass in Mozilla Firefox before 157 and Firefox ESR before 153.4 permits unauthenticated remote attackers to defeat DOM Navigation protections by luring a victim to load attacker-controlled web content, potentially compromising confidentiality and integrity of cross-origin data or actions if the victim is simultaneously authenticated to a targeted site. Although the CVSS base score is 8.1, the vector requires user interaction (UI:R), EPSS is only 0.15% (4th percentile), and no public exploit has been identified at time of analysis, making this a genuine but non-emergency browser vulnerability. CISA SSVC records no exploitation and no automatable exploitation, while noting total technical impact.
Unauthenticated remote attackers can bypass a DOM:Security mitigation in Mozilla Firefox (versions before 157 and Firefox ESR before 153.4) by enticing a victim to load attacker-controlled web content, defeating a browser protection mechanism rather than exploiting a memory-safety bug directly. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) and a scope change indicate high potential confidentiality, integrity and availability impact once the defense is circumvented, but the independent assessment characterizes this as a weakening primitive: full impact generally requires chaining with a separate content-process vulnerability, so it is not a self-contained compromise. Exploitation signals conflict sharply - a critical-looking CVSS score against an EPSS of only 0.15% (4th percentile), a CISA SSVC rating of Exploitation: none / Automatable: no, and no public exploit identified at time of analysis; there is no confirmed actively exploited (CISA KEV) status.
Mitigation bypass in Mozilla Firefox's Bookmarks & History component lets attacker-controlled web content defeat a built-in browser security protection, weakening the defenses that normally contain malicious pages. The issue affects Firefox builds prior to 157 and Firefox ESR builds prior to 153.4, is reachable without authentication (PR:N) but requires the victim to load attacker-supplied content (UI:R), and is confirmed fixed by the vendor in Firefox 157 and Firefox ESR 153.4. Independent assessment rates the real-world consequence as limited (C:L/I:L/A:N) because bypassing the protection alone yields little damage and must be chained with a separate content-process vulnerability to reach the headline CVSS 9.6 impact; EPSS is 0.15% (4th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
Use-after-free in the JavaScript JIT compiler of Mozilla Firefox (versions before 157) and Firefox ESR (before 153.4) allows remote attackers to corrupt memory and potentially execute code within the browser process when a victim loads attacker-controlled JavaScript from a malicious or compromised page. Exploitation requires user interaction (the victim must navigate to the crafted content), and while CVSS 8.8 indicates high confidentiality, integrity, and availability impact, no public exploit code or active exploitation in the wild has been identified at the time of analysis. The flaw is fixed in Firefox 157 and Firefox ESR 153.4.
Privilege escalation in Mozilla Firefox's Places component lets a remote attacker reach elevated, normally chrome-restricted functionality inside the browser when a victim opens attacker-controlled web content in an affected build. Affected releases are Firefox versions before 157 and Firefox ESR versions before 153.4, rated 8.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which means no attacker-side authentication or privileges are required but the victim must be induced to interact with a crafted page, after which confidentiality, integrity and availability impact is total within the affected security scope (CWE-269 improper privilege management). There is no public exploit identified at time of analysis and no CISA KEV entry; CISA SSVC rates exploitation as "none" and the attack as not automatable, so this is a serious browser flaw rather than a current worm or mass-exploitation emergency, and it is fully resolved by updating to Firefox 157 or Firefox ESR 153.4.
Privilege escalation in the Mozilla Firefox Address Bar component lets a remote, unauthenticated attacker gain elevated privileges within the browser by persuading a victim to load and interact with attacker-controlled web content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms no credentials are needed but the attack cannot succeed without the targeted user interacting with the malicious page, and CISA's SSVC assessment marks the issue as not automatable with no observed exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis; the flaw is remediated in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17, so only unpatched installations prior to those builds remain exposed.
Sandbox escape in Mozilla Firefox stems from improper boundary checks in the XPCOM component, allowing remote attackers to break out of the browser's content sandbox and compromise the host when a victim loads attacker-controlled web content. The flaw carries a CVSS 9.6 with required user interaction (UI:R) and no authentication (PR:N), affecting unpatched versions below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42. No public exploit identified at time of analysis, and CISA SSVC records Exploitation: none, so this is a high-severity patching priority rather than a confirmed active threat.
A use-after-free in Mozilla Firefox's Widget:Gtk component enables a sandbox escape: an unauthenticated remote attacker who persuades a user to load attacker-controlled web content can corrupt freed heap memory in the GTK widget rendering path and cross the browser's security boundary (CVSS 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), turning a rendering bug into code-execution-class impact outside the sandbox. GTK-based (Linux/Unix) Firefox builds are the primary target surface, and the flaw affects Firefox releases prior to 157 as well as the ESR branches prior to 153.4 and 140.17, where Mozilla has shipped the fix. No public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automation rated 'no', although the assessed technical impact is total if the bug is successfully triggered; the principal hurdles are the required user interaction and the difficulty of reliably grooming a UAF into a working sandbox escape.
Cross-origin data exposure and integrity compromise in Mozilla Firefox stem from a site-isolation failure in the DOM:Networking component, where origin boundaries are not correctly enforced, allowing attacker-controlled web content to reach resources and operations that should belong to a different origin. Affected are Firefox builds before 157 and Firefox ESR builds before 153.4; the issue is rated 8.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), meaning remote, unauthenticated, low-complexity exploitation that nonetheless requires the victim to load a malicious or compromised page. There is no public exploit identified at time of analysis and EPSS is very low at 0.15% (4th percentile), so real-world activity is not indicated, but the confidentiality and integrity impact is high once a user is lured to attacker-controlled content.
Use-after-free in Mozilla Firefox's CSS Parsing and Computation component allows a remote attacker to corrupt browser memory and potentially achieve code execution in the content process by getting a victim to render attacker-controlled web content. The flaw affects Firefox before 157 and Firefox ESR before 153.4 (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), and although no authentication or non-default configuration is required, exploitation is not zero-click - the target must actually load the malicious page, win the use-after-free race, and defeat browser memory hardening. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score or KEV listing was provided, so this sits in the high-CVSS but moderate-real-world-priority band rather than an emergency-patch category.
Remote code execution in Mozilla Firefox's SpiderMonkey JavaScript JIT engine allows unauthenticated attackers to corrupt memory via crafted web content, potentially leading to arbitrary code execution within the browser's content process. Exploitation requires the victim to visit or be redirected to a malicious page (UI:R) that triggers incorrect boundary conditions during JIT compilation; JIT is enabled by default, so no special victim configuration is needed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is near-critical due to the high-value JIT attack surface. Fixed in Firefox 157 and Firefox ESR 153.4.
Remote code execution within the browser process could be achieved in Mozilla Firefox before version 157 through an invalid pointer release in the JavaScript JIT compiler. A remote, unauthenticated attacker can trigger this by convincing a user to visit a malicious webpage, requiring user interaction but no privileges. No public exploit code has been identified at time of analysis, and the CVSS base score is 8.8.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the DOM: Core & HTML component, allowing attacker-controlled web content to corrupt memory and break out of the browser's content-process sandbox. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17; the flaw carries a CVSS 9.6 rating (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the scope change (S:C) reflects escape from the renderer sandbox into the wider browser/OS context with high confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV; however, exploitation only requires a victim to load attacker-controlled content (UI:R) and needs no authentication or non-default configuration, so browser auto-update to a fixed build fully removes exposure.
Information disclosure in Mozilla Firefox DevTools versions prior to 157 allows an unauthenticated remote attacker to potentially expose sensitive data when a victim interacts with the browser's developer tools while viewing attacker-influenced content. Exploitation requires user interaction (UI:R) and is client-side only; no public exploit code has been identified at time of analysis (EPSS 0.15%, percentile 4%). The vulnerability is fixed in Firefox 157.
A same-origin policy bypass in Firefox's DevTools component allows attacker-controlled content to read and modify data belonging to other origins the victim is already authenticated to, rated CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The flaw affects Firefox builds before 157 and Firefox ESR builds before 153.4; exploitation is remote and requires no attacker-side credentials, but is gated by user interaction because the victim must load attacker-controlled content and reach the vulnerable DevTools same-origin-policy code path. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), while Mozilla has shipped vendor fixes in Firefox 157 and Firefox ESR 153.4.
Improper enforcement of a built-in DOM security mitigation in Mozilla Firefox's Service Workers component allows remote, unauthenticated attackers to bypass that protection when a victim loads attacker-controlled web content, with a successful bypass potentially yielding high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires the user to visit a malicious or compromised page that registers or abuses a Service Worker (UI:R, PR:N); the underlying CPE confirms only the Mozilla Firefox browser family (versions before 157 and before ESR 153.4) is affected. At time of analysis there is no public exploit identified and no confirmed active exploitation, EPSS is low at 0.16% (4th percentile), and CISA SSVC rates exploitation as 'none' and automatable as 'no', indicating a moderate rather than emergency priority. Because this is a protection-mechanism bypass (CWE-693), realistic full impact likely depends on chaining with a second flaw rather than standalone compromise.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component allows a remote, unauthenticated attacker (CVSS vector PR:N) to elevate privileges inside the browser after convincing a victim to visit an attacker-controlled or compromised page (UI:R), affecting Firefox builds before 157 and ESR branches before 153.4 and 140.17. The 8.8 score derives from high confidentiality, integrity, and availability impact with low attack complexity, but scope is unchanged (S:U), meaning the impact stays confined to the browser's own privilege boundary rather than escaping to the host operating system. There is no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no, so practical exposure is driven by how quickly the supplied ESR/rapid-release fixes are deployed rather than by observed attack activity.
A race condition in Mozilla Firefox's Audio/Video component can culminate in a use-after-free, potentially allowing memory corruption when a victim loads attacker-controlled media content in any Firefox build prior to version 157. Exploitation is unauthenticated over the network but demands both user interaction (the victim must visit or interact with a crafted page) and a precisely won, non-deterministic timing window between concurrent media-processing operations, which makes the bug high-complexity and not automatable (SSVC Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Firefox 157 as the fix per advisory mfsa2026-97.
Use-after-free in Mozilla Firefox's Preferences: Backend component before version 157 enables a sandbox escape, allowing attacker-controlled web content to break out of the browser's renderer sandbox and gain code execution with browser privileges; exploitation requires the victim to load attacker-controlled content (UI:R) with no authentication or special privileges (PR:N), and default configurations are affected. Mozilla addressed this in Firefox 157 via the mfsa2026-97 advisory, and while the CVSS 9.6/S:C scoring reflects a genuinely high-severity memory-corruption issue, no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Same-origin policy bypass in Mozilla Firefox's WebExtensions component lets attacker-controlled web content defeat origin isolation and access cross-origin data, producing high confidentiality and integrity impact without availability loss. Exploitation requires a victim running an affected build (prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42) to visit or interact with attacker-controlled content - the CVSS UI:R prerequisite - while no authentication or prior privileges are needed on the attacker side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1); default configurations are affected because the flaw sits in a core browser component. No public exploit code has been identified at time of analysis, EPSS is low at 0.17% (5th percentile), and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is currently a patch-now hardening issue rather than an actively exploited one.
Privilege escalation in the DLL Services component of Mozilla Firefox allows an attacker to achieve elevated code execution - with high confidentiality, integrity, and availability impact - when a victim renders attacker-controlled web content, reflected in a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication is required (PR:N) and attack complexity is low, but the vector mandates user interaction (UI:R), meaning a target must be induced to load a crafted page rather than being compromised by a service-side drive-by. The issue is fixed in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17, so unpatched pre-157 and pre-ESR builds are the exposed population; there is no public exploit code and no observed exploitation at time of analysis, and SSVC classifies the flaw as non-automatable.
Sandbox escape in Mozilla Firefox allows remote attackers to break out of the content sandbox by exploiting a use-after-free in the browser's Disability Access (accessibility) APIs. Affected are Firefox versions before 157 and Firefox ESR versions before 153.4; the attack is network-delivered and requires no authentication, but is not zero-click - the victim must open attacker-controlled web content that exercises the accessibility APIs and win the use-after-free race (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Mozilla has fixed the flaw in Firefox 157 and Firefox ESR 153.4, and no public exploit has been identified at time of analysis; the score reflects the high confidentiality, integrity, and availability impact combined with scope change once the sandbox boundary is crossed, while the UI:R component keeps it from being self-propagating.
Storage data exposure in Mozilla Firefox stems from cryptography misuse in the Storage: Quota Manager component, allowing remote, unauthenticated attackers to trigger information disclosure if a victim loads attacker-controlled web content (UI:R, PR:N). The independent assessment rates confidentiality impact High and integrity impact Low (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), with affected versions being Firefox before 157 and Firefox ESR before 153.4. No public exploit was identified at time of analysis, and EPSS is low at 0.15% (4th percentile), so this is a moderate-priority patching item rather than an urgent, actively exploited issue.
Use-after-free in Mozilla Firefox's Graphics: WebRender compositor lets remote, unauthenticated attackers corrupt memory and escalate privileges inside the browser when a victim loads attacker-controlled web content - no authentication is required (PR:N), but the attack is not server-side passive and depends on the target visiting or interacting with a malicious or compromised page (UI:R). The flaw rates CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was fixed in Firefox 157 and in Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but not urgent priority. Modern Firefox content-process sandboxing further limits post-corruption impact unless the attacker chains a separate sandbox escape, and WebRender is enabled by default, so no unusual configuration is needed to reach the vulnerable path.
Use-after-free in Mozilla Firefox's WebAssembly engine (JavaScript/SpiderMonkey component) allows an unauthenticated remote attacker to corrupt browser memory and potentially achieve code execution against users running Firefox versions prior to 157. Exploitation requires the victim to open attacker-controlled web content that exercises a crafted WebAssembly module (UI:R), and while no public exploit code has been identified at time of analysis and the issue is not on CISA KEV, the CVSS 3.1 base score of 8.8 with C:H/I:H/A:H reflects a full high-impact memory-corruption outcome typical of an RCE-class heap use-after-free. Users on Firefox 157 or later are not affected.
Mozilla Firefox's Internationalization component contains incorrect boundary conditions that permit a sandbox escape, allowing an attacker who already has code execution inside the content process to break out of the browser sandbox. The flaw affects Firefox before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; exploitation requires a victim to load attacker-controlled web content (UI:R) and typically must be chained with a separate content-process memory-corruption vulnerability because this is not a direct remote code execution flaw. No public exploit code has been identified at the time of analysis, and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity despite the critical CVSS score of 9.6.
JIT miscompilation in Firefox's WebAssembly engine allows crafted WebAssembly delivered through attacker-controlled web content to corrupt in-process memory via a type confusion (CWE-843), producing high confidentiality impact and limited integrity impact but no availability impact. The flaw is remotely reachable at low complexity and unauthenticated (AV:N/AC:L/PR:N) but is gated by user interaction (UI:R) - the victim must load a malicious page that exercises the vulnerable JIT path - and by the content-process sandbox, so on its own it yields in-process memory disclosure rather than host compromise, which would require chaining a separate sandbox-escape bug. Mozilla has fixed it in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17; EPSS is only 0.16% (4th percentile) and no public exploit or CISA KEV entry was identified at time of analysis.
Use-after-free in the DOM: Core & HTML engine of Mozilla Firefox allows memory corruption that can be driven by attacker-controlled web content, potentially yielding code execution or memory disclosure inside the browser's content process. Affected are Firefox releases before 157 and the ESR branches before 153.4, 140.17, and 115.42; exploitation only requires that the victim load a malicious or compromised page (UI:R) with no authentication and no non-default settings, since the DOM Core/HTML code path is always active. Mozilla has published fixed versions and no public exploit was identified at time of analysis, and the achievable impact is bounded by Firefox's content-process sandbox unless chained with a separate escape.
Use-after-free in Mozilla Firefox's XSLT engine lets a remote, unauthenticated attacker corrupt memory by getting a victim to render attacker-controlled content that performs an XSL transformation, with the assessed CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflecting high confidentiality, integrity, and availability impact. The flaw affects Firefox builds before 157 and ESR builds before 153.4, 140.17, and 115.42, and is remediated in those releases. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); the main practical barrier is the mandatory user interaction, since the victim must visit or render the malicious content for the XSLT path to execute.
Use-after-free in Mozilla Firefox's Graphics: Canvas2D rendering component allows a remote, unauthenticated attacker to corrupt browser memory and potentially achieve arbitrary code execution when a victim loads crafted web content in an unpatched build. Exploitation hinges on user interaction - the victim must open a malicious or compromised page that exercises the Canvas2D path - and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects high confidentiality, integrity, and availability impact confined to the browser process by the renderer sandbox. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), making this a serious client-side bug rather than an emergency; vendor-released fixes are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.
Memory corruption in Mozilla Firefox's JavaScript and WebAssembly engine (CWE-824, access of uninitialized pointer) allows a crafted or compromised web page to trigger an invalid-pointer dereference in the browser's content process, potentially resulting in information disclosure or code execution within that process. Exploitation requires the victim to navigate to attacker-controlled content in a pre-patch build - Firefox before 157, Firefox ESR before 153.4, or Firefox ESR before 140.17 - and is unauthenticated per the assessed CVSS vector (AV:N/PR:N), although the vendor's 9.8 score assumes no user interaction while our independent assessment requires UI:R, so the effective risk should be reconciled before treating this as an emergency. No public exploit code has been identified at time of analysis (no KEV listing, no POC) and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity.
A sandbox escape in Firefox's XUL component allows attacker-controlled content to break out of the browser's security boundary and gain the privileges of the parent process, resulting in high confidentiality and integrity impact with changed scope (CVSS 9.6). Exploitation requires the victim to load or interact with attacker-controlled content (UI:R), but no credentials are needed (PR:N), and default Firefox configurations are affected; SSVC rates the issue non-automatable, so mass-scanning-style campaigns are unlikely. The flaw is fixed in Firefox 157 and Firefox ESR 153.4, no public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low (0.15%, 4th percentile).
Use-after-free memory corruption in Mozilla Firefox's Graphics component can be exploited by a remote, unauthenticated attacker to escape the browser's content sandbox and run code at the privilege of the parent/broker process, provided the victim renders attacker-controlled content. The only prerequisite is user interaction - visiting or rendering a crafted page in any unpatched build (Firefox before 157, ESR before 153.4, ESR 140.17, ESR 115.42) - since graphics rendering is enabled by default and no credentials are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6). No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the independent assessment notes that reliable heap grooming of the use-after-free is non-trivial, making this a high-priority RCE-class flaw rather than a demonstrated weaponized one.
Memory corruption in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger a use-after-free when a victim loads attacker-controlled web content, potentially leading to arbitrary code execution, information disclosure, or crashes. Affected versions include Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42; the flaw is patched in those fixed releases. Exploitation requires user interaction in default browsing and must contend with Firefox sandboxing and heap-hardening mitigations; no public exploit identified at time of analysis (no CISA KEV confirmation).
A use-after-free in Firefox's Layout: Text and Fonts component lets remote attackers corrupt memory by enticing a victim to open crafted web content, potentially leading to code execution within the browser's content process. Unauthenticated network attackers can trigger it with low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) confirms a successful attack requires user interaction and no privilege is needed beforehand. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; there is no CISA KEV entry and no public exploit identified at time of analysis, though the memory-corruption class makes weaponization plausible.
Boundary-condition errors in Mozilla Firefox's Graphics component allow an unauthenticated remote attacker to trigger memory corruption and achieve privilege escalation on the affected platform, provided the victim loads attacker-controlled content that reaches the vulnerable rendering code path. Only builds below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 are affected - updating to any of those versions fully remediates the issue. Although the CVSS base score is 8.8 with high confidentiality, integrity, and availability impact, no public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable, and the mandatory user-interaction requirement (UI:R) prevents automated or wormable spread, making this a genuine but not top-priority issue.
A sandbox escape in Mozilla Firefox's Graphics: WebRender component lets attacker-controlled web content break out of the browser's content-process sandbox and reach the parent/broker process, with a 9.6 CVSS score driven by scope change plus high confidentiality, integrity and availability impact. Successfully triggering it requires an unpatched build and mandatory user interaction (PR:N, UI:R) - the victim must load or render a malicious page that exercises the WebRender path - and because the flaw sits in the rendering/sandbox boundary rather than in a directly reachable network service, realistic abuse typically depends on chaining it with a separate content-process compromise, which is consistent with SSVC rating Exploitation 'none' and Automatable 'no'. Fixed builds are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42; there is currently no public exploit identified at time of analysis and EPSS is low at 0.16% (4th percentile), so exploitation signals are sharply split between the very high severity rating and the low likelihood evidence.
A use-after-free flaw in Firefox's DOM Core & HTML component (CWE-416) can corrupt browser memory when a victim loads attacker-controlled web content, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All supported release channels are affected below the fixed builds - Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 - and the flaw is exploitable by unauthenticated remote attackers only if the user actively visits or is induced to load a malicious page (UI:R), with no server-side exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact ranges from information disclosure and memory corruption to a potentially exploitable crash or code execution, though reliable exploitation requires winning the heap reallocation race and defeating browser sandbox mitigations, placing it in the normal severity band for this bug class rather than an emergency.
A use-after-free in Mozilla Firefox's XSLT (XML stylesheet transformation) engine can be triggered when a victim loads attacker-controlled content that exercises stylesheet processing, allowing memory corruption that jeopardizes confidentiality, integrity, and availability of the browser session. The flaw affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires no privileges (PR:N) but does require user interaction (UI:R) - the target must open a malicious page or XML document, with no zero-click or server-side path indicated by the available data. Mozilla has released fixed versions across all supported release and ESR channels; no public exploit code was identified at time of analysis.
Use-after-free in Mozilla Firefox's DOM Core & HTML engine allows attacker-controlled web content to corrupt memory and escape the browser's content sandbox, potentially yielding code execution at higher privilege on the host. Affected are Firefox builds prior to 157 and ESR branches prior to 153.4, 140.17, and 115.42; the flaw is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), so no authentication or non-default configuration is required, but a victim must load or render a malicious page (UI:R). No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited, though the scope-changed rating reflects that a successful trigger crosses a security boundary rather than merely crashing a content process.
Use-after-free in the Graphics: Canvas2D component of Mozilla Firefox allows remote, unauthenticated attackers to corrupt browser memory when a victim renders attacker-controlled web content - a malicious page, ad, or iframe provides the required user interaction (UI:R). Successful exploitation can expose or modify memory (high C/I/A impact per the 8.8 CVSS), causing crashes and potentially arbitrary code execution inside the content/renderer process, although turning the primitive into reliable code execution also requires defeating Firefox's site isolation, sandbox, and ASLR hardening, which keeps practical difficulty above the raw score. Only unpatched builds are affected; Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42 carry the fix, and no public exploit code or active exploitation was identified at the time of analysis.
A use-after-free in Mozilla Firefox's WebAssembly component allows remote attackers to potentially execute arbitrary code by enticing a victim to visit a malicious web page. The vulnerability affects Firefox versions before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; no authentication or non-default configuration is required, but exploitation requires user interaction (UI:R). No public exploit code or active exploitation has been identified at time of analysis, and browser process sandboxing limits the impact.
Sandbox escape in Mozilla Firefox's Graphics component allows unauthenticated remote attackers to break out of the browser's content sandbox when a victim renders attacker-controlled web content (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C, score 9.6). Affected builds are Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42, all of which now have vendor fixes available across their respective release trains. Exploitation requires chaining the escape with a separate content-process compromise to achieve code execution, which is consistent with CISA SSVC's 'Automatable: no' and 'Exploitation: none' ratings; EPSS is low at 0.16% (4th percentile) and no public exploit code has been identified at time of analysis.
Use-after-free in Mozilla Firefox's DOM: Core & HTML implementation lets remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content in an unpatched build. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is network-reachable and low-complexity and requires no authentication, but does depend on user interaction - the victim must open a malicious or compromised page. Every supported channel is affected prior to the fixed releases (Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42); there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though successful heap grooming of the freed DOM object can escalate beyond a crash within the constraints of Firefox's sandbox and mitigations.
Use-after-free in Mozilla Firefox's IndexedDB storage implementation allows a remote, unauthenticated attacker to execute arbitrary code with the victim's privileges by convincing them to load attacker-controlled web content that exercises the IndexedDB API. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact, with the only meaningful barrier being the required user interaction - no authentication or non-default configuration is needed. Mozilla fixed the flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; no public exploit code or confirmed active exploitation was identified at time of analysis, but given Firefox's enormous install base and the browser-context code execution primitive, this warrants priority patching rather than emergency escalation.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component (CWE-416) lets remote attackers achieve full confidentiality and integrity impact against unpatched Firefox builds when a victim simply loads attacker-controlled web content, matching the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Firefox versions prior to 157, Firefox ESR prior to 153.4, and Firefox ESR prior to 140.17; exploitation needs no authentication or non-default configuration, and the mandatory browsing/user interaction is the primary limiting factor. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but Mozilla has shipped fixed builds, so prioritization should focus on unpatched endpoints in browser-exposed or high-value user populations.
Undefined behavior in the DOM Streams component of Mozilla Firefox allows remote, unauthenticated attackers to trigger memory-safety-class corruption in the browser process when a victim loads attacker-controlled web content, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R). The flaw affects builds prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, and requires user interaction - the victim must open a crafted page that exercises the vulnerable Streams API path - but no authentication or non-default browser configuration is needed. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue; EPSS is very low at 0.16% (4th percentile), though the underlying CWE-758 memory-safety class means reliable weaponization would require substantial exploit-development effort rather than being trivially scriptable.
Mozilla Firefox can be driven to escape its content sandbox through a use-after-free in the DOM Content Processes component, letting a remote, unauthenticated attacker who convinces a victim to load a crafted page (UI:R, PR:N) corrupt memory in the sandboxed content process and cross into the more privileged parent process - the pivot reflected in the CVSS 9.6 scope-change rating and the C:H/I:H/A:H metrics. The flaw affects Firefox before 157 and the ESR trains before 153.4, 140.17 and 115.42, and it is fixed in those exact builds. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly component lets remote attackers corrupt memory and potentially achieve code execution or disclose sensitive data when a user loads attacker-controlled web content containing a malicious WebAssembly payload. The flaw affects default Firefox configurations up to Firefox 157 and the ESR branches-Firefox ESR 153.4 and Firefox ESR 140.17 are the first fixed releases-and requires no authentication, only that the victim browse a crafted page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a genuine but not top-tier priority; exploitation is client-side and requires user interaction, and because scope is unchanged the initial impact is confined to the content process unless chained with a separate sandbox-escape bug.
Use-after-free in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to corrupt memory and potentially achieve code execution or read sensitive data when a victim loads attacker-controlled web content that exercises the WebGPU API; the flaw is fixed in Firefox 157. Exploitation is gated by user interaction (CVSS PR:N, UI:R) and by WebGPU being reachable in the victim's build, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The 8.8 CVSS score reflects high confidentiality and integrity impact within the affected browsing process, though the content-process sandbox typically limits standalone impact unless chained with a sandbox escape.
Mozilla Firefox builds prior to version 157, along with the ESR branches prior to 153.4, 140.17, and 115.42, contain a use-after-free in the Networking: Cache component that lets a remote attacker corrupt memory by persuading a victim to render attacker-controlled web content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is the classic browser drive-by profile: no authentication is required, complexity is low, but exploitation depends on the user navigating to or loading a malicious page that reaches the specific cache code path, and the content-process sandbox limits how far a single use-after-free can be pushed toward full system compromise. The flaw is patched in Firefox 157 and Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no CISA KEV listing and no public exploit code were identified at time of analysis, so this is a patch-now, high-severity memory-safety bug rather than a confirmed actively exploited one.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine enables remote code execution or memory corruption when a victim views a malicious webpage, requiring only that the user loads attacker-controlled content (UI:R) with no authentication (PR:N). The flaw affects all Firefox versions prior to 157 and Firefox ESR prior to 153.4, and is rated CVSS 8.8 due to high confidentiality, integrity, and availability impact; the content-process sandbox (S:U) limits impact to the browser process absent a separate escape. No public exploit identified at time of analysis, and no CISA KEV listing; Mozilla has released patches in Firefox 157 and Firefox ESR 153.4.
Privilege escalation in Mozilla Firefox versions prior to 157 arises from incorrect boundary conditions in the Graphics: WebGPU component, a CWE-119 buffer-bounds flaw that a remote, unauthenticated attacker can trigger when a victim loads attacker-controlled web content. Exploitation depends on user interaction (UI:R) - typically visiting a malicious or compromised page - and is rated CVSS 8.8 with high confidentiality, integrity and availability impact, though scope is unchanged (S:U) so the effect is confined to Firefox's content process rather than the host operating system. No public exploit code was identified and CISA's SSVC assessment records Exploitation: none, so this is a mid-to-high priority browser patch rather than an emergency; the issue is fixed in Firefox 157.
Memory corruption in Mozilla Firefox's WebGPU graphics component (versions prior to 157) can be triggered when a user loads attacker-controlled web content that drives the vulnerable rendering path, yielding a buffer overflow with high confidentiality and availability impact. The flaw is remote, requires no authentication, and exploitation depends on the victim rendering a malicious page, so practical attacks rely on phishing, malvertising, or a compromised site rather than zero-click delivery. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.15% (4th percentile), though the vendor's 9.1 CVSS rating and a patch in Firefox 157 indicate a serious memory-safety defect that should be prioritized for browser fleet updates.
A use-after-free in Firefox's DOM Content Processes component lets unauthenticated remote attackers escape the content-process sandbox by getting a victim to render attacker-controlled web content, resulting in high confidentiality, integrity and availability impact across a changed security scope (CVSS 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The mandatory user interaction (loading or rendering the malicious page) is the primary limiting factor, and no authentication or elevated privileges are required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42, so patched or auto-updated installations are unaffected.
A use-after-free in Mozilla Firefox's Graphics: WebGPU component (CWE-416) lets a remote attacker who gets a victim to render attacker-controlled web content corrupt memory and potentially achieve code execution in the browser's process, earning a High-severity CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All Firefox builds prior to 157 are affected, and Mozilla fixed the issue in Firefox 157 (advisory mfsa2026-97, Bugzilla 2059020). No public exploit code or confirmed active exploitation has been identified at time of analysis, and because the vector requires user interaction, mass automated exploitation is unlikely, though per-target heap grooming is needed for reliable execution.
Sandbox escape in Mozilla Firefox's Security: Process Sandboxing component allows an attacker to break out of the browser's content-process sandbox when a victim loads attacker-controlled web content, yielding full confidentiality, integrity, and availability impact on the host. The flaw is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), unauthenticated (PR:N) but requiring user interaction (UI:R), and affects Firefox versions prior to ESR 153.4 and Firefox 157. EPSS is low at 0.15% (4th percentile) and no public exploit code has been identified at time of analysis, though CISA SSVC assigns total technical impact with no known exploitation.
Uninitialized memory handling in Mozilla Firefox's Storage Quota Manager can leak contents of the browser's process memory to a remote attacker who persuades a victim to load attacker-controlled web content, affecting Firefox releases before 157 as well as ESR builds before 153.4, 140.17, and 115.42. The required user interaction (UI:R) is the main limiting factor, and no privileges are needed (PR:N); the independently assessed impact is confidentiality disclosure only, with no code execution or availability effect established, and triage should not treat the published I:H/A:N components of the 8.1 CVSS score as realized. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), with vendor-supplied fixes already available in Firefox 157 and the three ESR branches.
Sandbox escape in Mozilla Firefox's DOM Navigation component (CVE-2026-100758, CVSS 9.6) lets attacker-controlled web content escape the content-process sandbox and reach high-integrity resources on the host once a user loads a malicious or compromised page, ad, or embedded frame. The flaw requires no authentication or special privileges but does require the victim to visit the attacker's content (UI:R), and because the escape changes security scope (S:C) with high confidentiality, integrity, and availability impact, every pre-fix Firefox build - including the legacy ESR 115 branch - is exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Mozilla shipped fixes in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, so risk is concentrated in unpatched installs and in organizations that lag on ESR updates.
Use-after-free (CWE-416) in Mozilla Firefox's Widget component allows remote attackers to potentially execute arbitrary code when a victim renders attacker-controlled web content in unpatched versions (before Firefox 157, Firefox ESR 153.4, ESR 140.17, or ESR 115.42). Successful exploitation requires reliable heap manipulation and depends on the user opening malicious content (UI:R), but can achieve high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Memory-corruption flaws in Firefox's Audio/Video Playback component (CWE-119) can be triggered when a user loads attacker-controlled audio or video content, potentially leading to high-integrity and high-confidentiality compromise of the browser process. The issue affects Firefox builds prior to 157 and the ESR branches prior to 153.4, 140.17, and 115.42, is rated CVSS 3.1 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), and requires user interaction - the victim must visit a malicious page or open crafted media that reaches the playback stack. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.
An out-of-bounds read in Mozilla Thunderbird's IMAP response parser affects all builds prior to Thunderbird 156 and prior to Thunderbird 140.16 (ESR), allowing a malicious or compromised IMAP server to crash the mail client and potentially expose a limited amount of process memory by sending a crafted untagged '* ID' response. The flaw is reachable before authentication (CVSS vector PR:N/UI:N), so an attacker needs no mailbox credentials and no user click beyond the client connecting to a server they control, have compromised, or can intercept via man-in-the-middle; independent assessment sets confidentiality impact to Low and availability impact to High, which is milder than the 9.1 NVD base score. Exploitation requires the victim's Thunderbird to actually initiate an IMAP session to the attacker-controlled endpoint, and with EPSS at only 0.21% (12th percentile) and no CISA KEV entry or public exploit code identified, the severity signals conflict: a critical-looking base score against low real-world exploitation likelihood, mitigated by the availability of fixed builds in Thunderbird 156 and 140.16.
An out-of-bounds read in Mozilla Thunderbird's IMAP response parsing can disclose process memory or crash the client when the mail client connects to an attacker-controlled or compromised IMAP server, or when an on-path attacker injects crafted IMAP lines into a session. The flaw affects Thunderbird versions before 156 and Thunderbird ESR versions before 140.16, and is fixed in those releases; exploitation requires the victim's client to establish an IMAP session with the malicious endpoint (CVSS UI:R) while requiring no attacker authentication (PR:N). EPSS is 0.18% (8th percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Malformed email headers in Mozilla Thunderbird before 156 and 140.16 ESR can cause header parsing confusion or potential memory safety violations when a victim opens a crafted message, though code execution is only described as a potential outcome by the vendor. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.18% (percentile 8). The vulnerability requires user interaction (UI:R) because the victim must receive and render the malicious email, and the raw CVSS of 9.8 overstates real-world urgency for a desktop mail client.
Widget: Win32 mitigation bypass in Mozilla Firefox on Windows allows attacker-controlled web content to defeat a platform security protection (CWE-693); the flaw is fixed in Firefox 156 and Firefox ESR 153.3. Mozilla rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), implying unauthenticated remote compromise with no user interaction, but the independent assessment scores it AV:N/AC:H/PR:N/UI:R - a Windows-only precondition, a victim who actually renders the malicious page, and typically a second chained vulnerability are required before the bypass converts into high confidentiality/integrity impact. EPSS is 0.15% (5th percentile), and there is no CISA KEV entry or public exploit code identified at the time of analysis, so real-world exploitation pressure is currently low.