Cyber Posture

CVE-2026-2803

High

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0006 18.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-693

Mandates protection of the contingency plan against unauthorized disclosure, reducing exposure of sensitive recovery and operational information.

addresses: CWE-200 CWE-693

The integrated analysis team enables faster detection and containment of incidents involving unauthorized exposure of sensitive information, limiting attacker success in exploiting such weaknesses.

addresses: CWE-200 CWE-693

Protecting the incident response plan from unauthorized disclosure prevents exposure of sensitive organizational details and response procedures to unauthorized actors.

addresses: CWE-200 CWE-693

Sanitizing equipment to remove specified information before off-site maintenance prevents exposure of sensitive information to unauthorized actors such as external maintenance personnel.

addresses: CWE-200 CWE-693

Requires explicit protection of plans from unauthorized disclosure, directly reducing exposure of sensitive system and privacy information contained in them.

addresses: CWE-200 CWE-693

Privacy and security architectures require controls to protect sensitive information from unauthorized exposure across the system lifecycle.

addresses: CWE-693 CWE-200

Mandates determining protection needs from defined processes, reducing the likelihood that protection mechanisms are omitted or ineffective by design.

addresses: CWE-200 CWE-693

Trained staff understand data-handling requirements and are less likely to expose sensitive information through misconfiguration or poor design.

Security SummaryAI

CVE-2026-2803 is an information disclosure and mitigation bypass vulnerability in the Settings UI component of Mozilla Firefox and Thunderbird. It affects versions of these products prior to Firefox 148 and Thunderbird 148, in which the issue was fixed. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-693 (Protection Mechanism Failure).

The vulnerability can be exploited by any remote, unauthenticated attacker with network access and low attack complexity, requiring no user interaction. Successful exploitation enables the attacker to obtain high-impact disclosure of sensitive information from the affected browser or email client while bypassing existing security mitigations.

Mozilla's security advisories MFSA 2026-13 and MFSA 2026-16, along with Bugzilla entry 2012012, detail the patch applied in Firefox 148 and Thunderbird 148. Security practitioners should prioritize updating affected instances to these versions or later to mitigate the risk.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 148.0
mozilla
thunderbird
≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1555.003 Credentials from Web Browsers Credential Access
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Why these techniques?

Info disclosure + mitigation bypass in browser/email client Settings UI directly enables local data/credential harvesting from the affected application.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

References