PatchSiren cyber security CVE debrief

CVE-2026-2794 Mozilla CVE debrief

CVE-2026-2794 is a high-severity information disclosure vulnerability affecting Firefox and Firefox Focus for Android. The issue arises from uninitialized memory, which could potentially expose sensitive information. This vulnerability was addressed in Firefox version 148. Users are advised to update to the latest version to mitigate this risk. The CVE was published on February 24, 2026, and last modified on June 30, 2026.

Vendor: Mozilla
Product: Firefox
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-02-24
Original CVE updated: 2026-07-15
Advisory published: 2026-02-24
Advisory updated: 2026-07-15

Who should care

This vulnerability affects users of Firefox and Firefox Focus for Android. Given its high severity and potential for information disclosure, users and administrators should prioritize updating to Firefox version 148 or later. Additionally, defenders and security teams should be aware of this vulnerability to ensure proper mitigation and protection of sensitive information.

Technical summary

CVE-2026-2794 is caused by an information disclosure issue due to uninitialized memory in Firefox and Firefox Focus for Android. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The affected product is Mozilla's Firefox, with the vulnerability being fixed in version 148. The Common Weakness Enumeration (CWE) associated with this vulnerability is CWE-908. The attack vector is network-based, and the vulnerability does not require user interaction or privileges.

Defensive priority

High priority should be given to updating Firefox to version 148 or later to mitigate this vulnerability. Defenders should also ensure that all instances of Firefox and Firefox Focus for Android within their organization are updated to prevent potential exploitation.

Recommended defensive actions

Update Firefox to version 148 or later.
Ensure all instances of Firefox Focus for Android are updated to the latest version.
Review and update organizational policies to include checks for and mitigation of this vulnerability.
Monitor for any suspicious activity that could be related to this vulnerability.
Consider implementing additional security measures to protect sensitive information.

Evidence notes

The CVE-2026-2794 record was obtained from the official CVE database and the National Vulnerability Database (NVD). The vulnerability was disclosed by Mozilla and addressed in Firefox version 148. Additional information and mitigation strategies can be found in the Mozilla security advisories and related bug reports.

Sources and references

Verified primary and authoritative sources

CVE-2026-2794 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-2794

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-2794 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2794

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://www.mozilla.org/security/advisories/mfsa2026-13/

[email protected] - Vendor Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-2794

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2794.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.