Cyber Posture

CVE-2026-2771

Critical

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0003 8.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely identification, reporting, and correction of flaws like CVE-2026-2771 through patching affected Firefox and Thunderbird versions to prevent remote exploitation.

detect

Mandates vulnerability scanning to identify systems running vulnerable versions of Firefox and Thunderbird affected by CVE-2026-2771's out-of-bounds read.

detect

Ensures receipt and dissemination of security advisories like Mozilla's MFSA 2026-13, enabling awareness and remediation of CVE-2026-2771.

Security SummaryAI

CVE-2026-2771 is a high-severity vulnerability involving undefined behavior in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 148, Firefox ESR prior to 115.33 and 140.8, Thunderbird prior to 148, and Thunderbird prior to 140.8. The issue is associated with CWE-125 (out-of-bounds read) and carries a CVSS v3.1 base score of 9.8, indicating critical risk due to its potential for severe impact.

The vulnerability enables remote attackers to exploit affected browsers over the network with low attack complexity, requiring no privileges, no user interaction, and maintaining an unchanged scope. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or other severe compromises within the browser's rendering engine.

Mozilla's security advisories (MFSA 2026-13 through 2026-16) and the associated Bugzilla entry detail the fix, recommending immediate upgrades to Firefox 148, Firefox ESR 115.33 or 140.8, Thunderbird 148, or Thunderbird 140.8 to mitigate the issue. No workarounds are specified in the provided references.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 115.33.0 · ≤ 148.0 · 128.0 — 140.8.0
mozilla
thunderbird
≤ 140.8.0 · ≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Out-of-bounds read in browser DOM rendering engine enables remote arbitrary code execution with no privileges or user interaction, directly mapping to drive-by compromise via malicious web content and exploitation for client execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References