Executive brief
A critical security vulnerability has been identified in the Firefox web browser and Thunderbird email client. The issue exists within the JavaScript engine's memory management component, which is responsible for cleaning up unused data. If exploited, this could allow an attacker to execute malicious code or gain unauthorized access to the user's system simply by having the user visit a compromised website or view a malicious email.
Technical details
A use-after-free vulnerability exists in the JavaScript: GC (Garbage Collection) component of Mozilla's core engine. The flaw is rooted in the marking phase of the garbage collector, specifically within `js/src/gc/Marking.cpp`, where an assertion failure indicates improper handling of traced objects. An attacker can trigger this memory corruption by providing specially crafted JavaScript content, such as utilizing `FinalizationRegistry` and large `Int8Array` allocations to manipulate the heap state. This can lead to a crash or arbitrary code execution in the context of the browser process. The vulnerability is fixed in Firefox 148 and Thunderbird 148.
Affected products
- Mozilla Firefox < 148
- Mozilla Thunderbird < 148
Timeline
- 2026-02-24: disclosed
- 2026-02-24: advisory
- 2026-02-24: patched
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2010940
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://access.redhat.com/security/cve/CVE-2026-2795
- https://bugzilla.redhat.com/show_bug.cgi?id=2442305
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2795.json