Junglewise Threat Intelligence

CVE-2026-2767: Mozilla Firefox and Thunderbird use-after-free in WebAssembly array.fill

CVE-2026-2767 · Severity: critical · CVSS 9.8 · Published 2026-02-24

Technologies: Mozilla Thunderbird, Mozilla Firefox ESR, Mozilla Thunderbird ESR, Mozilla Firefox. Vendors: Red Hat, Mozilla.

Executive brief

A vulnerability exists in the WebAssembly component of Mozilla Firefox and Thunderbird. This component is responsible for running high-performance code within the browser. An attacker could exploit this flaw to execute unauthorized code or crash the application, potentially leading to the theft of sensitive user data or full system compromise. Users should update to the latest versions of Firefox and Thunderbird to mitigate this risk.

Technical details

A use-after-free (UAF) vulnerability exists in the SpiderMonkey JavaScript engine's WebAssembly baseline compiler. The root cause is a missing pre-write-barrier in the 'emitArrayFill' function when overwriting reference-typed array elements. This omission violates the 'snapshot-at-the-beginning' invariant required by the incremental garbage collector (GC). During an incremental GC cycle, a live object may be prematurely collected if its only remaining reference is overwritten without the GC being notified via the barrier. An attacker can reach this via web content using WasmGC (enabled by default since Firefox 135), leading to a dangling reference and potential arbitrary code execution. The issue was introduced in Bug 1851864 and is fixed in Firefox 148, Firefox ESR 140.8, and Thunderbird 148/140.8.

Affected products

  • Mozilla Firefox < 148
  • Mozilla Firefox ESR < 140.8
  • Mozilla Thunderbird < 148
  • Mozilla Thunderbird ESR < 140.8
  • Red Hat Enterprise Linux Server (v. 7 ELS) 7

Timeline

  • 2023-09-26: other: Vulnerability introduced via Bug 1851864
  • 2026-02-24: advisory: Mozilla Foundation Security Advisory published
  • 2026-02-24: patched: Fixed in Firefox 148 and ESR 140.8

References

Related threats