CVE-2026-2798
Published: 24 February 2026
Description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of the use-after-free flaw through patching to Firefox/Thunderbird 148 or higher.
Ensures receipt and dissemination of vendor advisories like MFSA2026-13 specifying patches for CVE-2026-2798.
Vulnerability scanning detects outdated Firefox/Thunderbird versions vulnerable to this DOM use-after-free exploitation.
Security SummaryAI
CVE-2026-2798 is a use-after-free vulnerability (CWE-416) in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. Published on 2026-02-24, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact. The flaw was addressed in Firefox version 148 and Thunderbird version 148.
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though user interaction—such as visiting a malicious webpage—is necessary. Successful exploitation could allow attackers to achieve high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution within the browser's rendering engine.
Mozilla's security advisories MFSA2026-13 and MFSA2026-16, along with Bugzilla entry 2014136, provide details on the vulnerability and its resolution. Mitigation requires updating affected systems to Firefox 148 or Thunderbird 148, or higher, to apply the necessary patches.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in browser DOM enables remote arbitrary code execution via malicious webpage visit, directly mapping to drive-by compromise and client-side exploitation techniques.