Cyber Posture

CVE-2026-2794

High

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0004 13.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148.

Security SummaryAI

CVE-2026-2794 is an information disclosure vulnerability stemming from uninitialized memory, classified under CWE-908. It affects Firefox and Firefox Focus for Android browsers. The issue was addressed in Firefox version 148, with the CVE published on 2026-02-24.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable remotely over the network with low complexity, no required privileges, and no user interaction. Attackers can achieve high-impact confidentiality violations, such as leaking sensitive data from memory, while integrity and availability remain unaffected.

Mozilla's security advisory MFSA2026-13 and Bugzilla bug 2008365 provide further details on the flaw. Mitigation requires updating to Firefox 148 or later versions where the vulnerability has been patched.

Details

CWE(s)
CWE-908

Affected Products

mozilla
firefox
≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1555.003 Credentials from Web Browsers Credential Access
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
attack.mitre.org →
Why these techniques?

Uninitialized memory disclosure in browser process directly enables reading of in-memory sensitive data such as session cookies, auth tokens and credentials, facilitating browser session hijacking, web session cookie theft and credential harvesting from browsers.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

References