CVE-2026-2770: Mozilla Firefox and Thunderbird use-after-free in DOM Bindings WebIDL

CVE-2026-2770 · Severity: critical · CVSS 9.8 · Published 2026-02-24

Mozilla Firefox and Thunderbird are popular web browsing and email applications used for accessing the internet and managing communications. A critical memory management flaw has been identified that could allow an attacker to potentially execute unauthorized code or crash the application. This occurs when the software incorrectly handles data in its internal web interface components, posing a risk to user data and system integrity if a user visits a malicious website or opens a specially crafted email.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Red Hat Enterprise Linux Server. Vendors: Mozilla, Red Hat.

Quick answers

Is CVE-2026-2770 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2770 being exploited in the wild.
How severe is CVE-2026-2770?
Critical severity, with a CVSS score of 9.8, published 24 February 2026.
Which products and versions are affected?
Mozilla Firefox < 148; Mozilla Firefox ESR < 115.33, < 140.8; Mozilla Thunderbird < 148, < 140.8; Red Hat Enterprise Linux Server affected.
Is there a fix for CVE-2026-2770?
A patch was published on 2026-02-24: Fixed in Firefox 148 and ESR versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2770 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-2770?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability was identified in the DOM: Bindings (WebIDL) component of Mozilla browsers and mail clients. The flaw occurs due to improper memory management when handling WebIDL bindings, which are responsible for the interface between JavaScript and the C++ DOM implementation. An attacker can exploit this by enticing a user to visit a malicious webpage or view a crafted email, leading to memory corruption. This can result in a stable application crash or potentially arbitrary code execution within the context of the browser process. The vulnerability is addressed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, and corresponding Thunderbird versions.

Affected products

  • Mozilla Firefox < 148
  • Mozilla Firefox ESR < 115.33, < 140.8
  • Mozilla Thunderbird < 148, < 140.8
  • Red Hat Red Hat Enterprise Linux Server (v. 7 ELS) affected

Timeline

  • 2026-02-24: advisory: Mozilla Foundation Security Advisory published
  • 2026-02-24: patched: Fixed in Firefox 148 and ESR versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.