PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2798 Mozilla CVE debrief

CVE-2026-2798 is a high-severity use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 148 and Thunderbird 148. It has a CVSS score of 8.8 and is classified as HIGH. The vulnerability was published on February 24, 2026, and last modified on June 30, 2026. The CVE record and NVD detail provide further information on this vulnerability.

Vendor
Mozilla
Product
Firefox
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-24
Original CVE updated
2026-07-15
Advisory published
2026-02-24
Advisory updated
2026-07-15

Who should care

Organizations and individuals using Firefox and Thunderbird should prioritize patching this vulnerability to prevent potential exploitation. The vulnerability's high severity and potential for exploitation make it essential for defenders to take immediate action. Additionally, security teams should review their inventory of affected systems and ensure that they are updated to the latest versions.

Technical summary

CVE-2026-2798 is a use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The vulnerability occurs when the browser's memory management system fails to properly handle objects, leading to a use-after-free condition. This can be exploited by attackers to execute arbitrary code on affected systems. The vulnerability is patched in Firefox 148 and Thunderbird 148. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Defensive priority

High priority should be given to patching this vulnerability in Firefox and Thunderbird. Defenders should review their inventory of affected systems and ensure that they are updated to the latest versions.

Recommended defensive actions

  • Patch Firefox and Thunderbird to version 148 or later
  • Review inventory of affected systems and ensure they are updated
  • Monitor for potential exploitation attempts
  • Implement compensating controls to detect and prevent exploitation
  • Track exception and remediation efforts

Evidence notes

The CVE record and NVD detail provide further information on this vulnerability. The vulnerability was published on February 24, 2026, and last modified on June 30, 2026. The CVSS score is 8.8, and the severity is classified as HIGH. The CWE for this vulnerability is CWE-416.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-2798 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-2798

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-2798 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2798

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.