CVE-2026-2766: Mozilla Firefox and Thunderbird use-after-free in JavaScript JIT engine

CVE-2026-2766 · Severity: critical · CVSS 9.8 · Published 2026-02-24

Mozilla Firefox and Thunderbird are affected by a critical security flaw in their JavaScript engine, which is responsible for running interactive content on websites and in emails. An attacker could exploit this vulnerability to execute unauthorized code or crash the application by tricking the software into using memory that has already been released. This could lead to a full system compromise or the theft of sensitive user data. Users should update to the latest versions of Firefox and Thunderbird immediately to protect their systems.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Red Hat Enterprise Linux AppStream EUS. Vendors: Mozilla, Red Hat.

Quick answers

Is CVE-2026-2766 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2766 being exploited in the wild.
How severe is CVE-2026-2766?
Critical severity, with a CVSS score of 9.8, published 24 February 2026.
Which products and versions are affected?
Mozilla Firefox < 148; Mozilla Firefox ESR < 140.8; Mozilla Thunderbird < 148; Red Hat Enterprise Linux AppStream EUS affected.
Is there a fix for CVE-2026-2766?
A patch was published on 2026-02-24: Fixed versions released for Firefox and Thunderbird. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2766 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-2766?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability was identified in the Just-In-Time (JIT) compiler component of the Mozilla JavaScript Engine (SpiderMonkey). The flaw occurs when the engine attempts to access memory that has been previously deallocated, typically during complex script execution or optimization phases. An unauthenticated remote attacker can exploit this by providing specially crafted JavaScript content via a webpage or email. Successful exploitation can lead to arbitrary code execution within the context of the application or a process crash. The vulnerability is addressed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Affected products

  • Mozilla Firefox < 148
  • Mozilla Firefox ESR < 140.8
  • Mozilla Thunderbird < 148
  • Mozilla Thunderbird < 140.8
  • Red Hat Enterprise Linux Server (v. 7 ELS) affected
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) affected

Timeline

  • 2026-02-24: advisory: Mozilla published security advisories MFSA2026-13 and MFSA2026-15.
  • 2026-02-24: patched: Fixed versions released for Firefox and Thunderbird.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.