Cyber Posture

CVE-2026-2762

Critical

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 6.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely identification, reporting, testing, and installation of patches for known flaws like the integer overflow in Mozilla's JavaScript Standard Library.

detect

Mandates vulnerability scanning to identify systems running vulnerable versions of Firefox and Thunderbird prior to the fixed releases.

prevent

Ensures receipt and dissemination of security advisories like MFSA 2026-13 through 17, enabling prompt awareness and patching of this CVE.

Security SummaryAI

CVE-2026-2762 is an integer overflow vulnerability (CWE-190) in the JavaScript Standard Library component of Mozilla products. It affects Firefox versions prior to 148, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird prior to 140.8.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating that a remote attacker requires no privileges or user interaction to exploit it over the network with low complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution within the browser or mail client context.

Mozilla addressed the issue in the specified fixed releases, as detailed in security advisories MFSA 2026-13, MFSA 2026-15, MFSA 2026-16, and MFSA 2026-17, along with Bugzilla entry 2011649. Security practitioners should ensure affected products are updated to patched versions to mitigate the risk.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 140.8.0 · ≤ 148.0
mozilla
thunderbird
≤ 140.8.0 · ≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Integer overflow in JS Standard Library enables remote arbitrary code execution in browser/mail client (no auth/UI required), directly facilitating drive-by compromise via malicious sites and exploitation for client execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References