PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2786 Mozilla CVE debrief

CVE-2026-2786 is a critical use-after-free vulnerability in Mozilla’s JavaScript Engine component. Mozilla fixed it in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Based on the NVD CVSS vector, the issue is reachable over the network, requires no privileges, and needs no user interaction, making timely patching important for both browser and mail client deployments.

Vendor
Mozilla
Product
CVE-2026-2786
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-24
Original CVE updated
2026-05-10
Advisory published
2026-02-24
Advisory updated
2026-05-10

Who should care

Security teams, endpoint administrators, and users of Firefox and Thunderbird should care, especially in environments that manage large desktop fleets or rely on rapid browser/mail client patch cycles.

Technical summary

NVD classifies the issue as CWE-416 (use-after-free) in the JavaScript Engine component. The NVD record lists affected Mozilla Firefox and Thunderbird branches ending before Firefox 148.0 / ESR 140.8.0 and Thunderbird 148.0 / ESR 140.8.0, with the fix referenced by Mozilla security advisories and a related Bugzilla issue.

Defensive priority

High. The CVSS score is 9.8 (Critical), and the published vector indicates network attackability with no privileges or user interaction required.

Recommended defensive actions

  • Upgrade Firefox to 148 or later, or Firefox ESR to 140.8 or later.
  • Upgrade Thunderbird to 148 or later, or Thunderbird ESR to 140.8 or later.
  • Verify fleet versioning against the NVD affected version ranges before and after remediation.
  • Prioritize systems that browse the public web or handle external email content.
  • Track the linked Mozilla advisories and Bugzilla record for any follow-up guidance or related fixes.

Evidence notes

The debrief is grounded in the NVD CVE record and Mozilla-linked references supplied in the source corpus. The record identifies the weakness as CWE-416 and provides the affected CPE criteria for Firefox and Thunderbird release and ESR branches. Mozilla vendor advisories are listed as references, along with a Bugzilla issue-tracking link. No exploit details are included beyond the official CVSS vector and vendor/NVD metadata.

Official resources

CVE published by NVD on 2026-02-24 and modified on 2026-05-10. Mozilla advisories referenced in NVD provide the vendor-side fix context for Firefox and Thunderbird.