Cyber Posture

CVE-2026-2797

Critical

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 5.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly addresses the CVE by requiring timely flaw remediation through patching Firefox and Thunderbird to version 148 or later, eliminating the use-after-free vulnerability in the JavaScript GC.

SI-16 Memory Protection partial match
prevent

Provides memory protections like ASLR, DEP, and stack canaries that mitigate exploitation of the use-after-free condition in the JavaScript Garbage Collector.

SC-39 Process Isolation partial match
prevent

Enforces process isolation via browser sandboxing to limit the impact of arbitrary code execution from the JavaScript GC use-after-free, preventing full system compromise.

Security SummaryAI

CVE-2026-2797 is a use-after-free vulnerability (CWE-416) in the JavaScript Garbage Collector (GC) component, affecting Mozilla Firefox and Thunderbird versions prior to 148. Published on 2026-02-24, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impact without requiring user interaction or privileges.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity by triggering the use-after-free condition in the JavaScript GC during web content processing. Successful exploitation could allow arbitrary code execution, leading to high impacts on confidentiality, integrity, and availability, such as full browser compromise and potential sandbox escape.

Mozilla's security advisories (MFSA 2026-13 and MFSA 2026-16) confirm the issue was addressed in Firefox 148 and Thunderbird 148. Security practitioners should ensure users update to these versions or later, with further technical details available in Bugzilla entry 2013561.

Details

CWE(s)
CWE-416

Affected Products

mozilla
firefox
≤ 148.0
mozilla
thunderbird
≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

UAF in browser JS GC enables remote arbitrary code execution on client via malicious web content (no auth/UI needed per CVSS), directly facilitating drive-by compromise (T1189) and exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References