CVE-2026-10701: Incorrect boundary conditions in the Graphics: Text component

Synopsis

An incorrect boundary condition in the Graphics: Text component of Mozilla Firefox allows a remote attacker to reach the affected service over the network without any authentication. Successful exploitation results in high-impact confidentiality loss, meaning an attacker can read sensitive data from the affected browser process. A patched-image rebuild at Firefox 151.0.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected Firefox instance over the network, as the CVSS vector specifies AV:N (network-adjacent exposure is sufficient, no physical or local access required).

• AuthenticationNot required

  No credentials or prior account access are needed; the vulnerability is reachable by any unauthenticated party that can send requests to the affected service (PR:N).

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required to trigger the vulnerability (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free with no race conditions or special environmental dependencies required (AC:L).

Blast Radius

• An attacker reads sensitive data from the Firefox browser process, which may include in-memory session tokens, cached credentials, or private browsing content.
• Confidentiality impact is rated High, meaning the attacker gains access to a significant portion of the data accessible within the affected process, not just isolated fragments.
• Integrity and availability are unaffected according to the CVSS vector, so the attacker cannot modify data or crash the service through this vulnerability alone.