Executive brief
Mozilla Firefox and Thunderbird were found to have a critical memory safety flaw in how they handle web page elements (specifically popovers). An attacker could exploit this by tricking a user into visiting a malicious website, potentially allowing the attacker to execute unauthorized code on the user's computer. This could lead to a total compromise of the user's data and system.
Technical details
A use-after-free (UAF) vulnerability exists in the 'Document::HidePopover' function within the DOM: Core & HTML component of Mozilla browsers. The root cause is a reentrancy issue where the 'beforetoggle' event is dispatched while a raw pointer to 'PopoverData' is held. A malicious script can handle this event to free the original 'PopoverData' (by removing the popover attribute) and then re-allocate it. Upon returning from the event handler, the browser continues to use the now-stale raw pointer, leading to a UAF. This can be exploited for remote code execution via heap spraying to control the freed memory and hijack virtual function calls (vtable). The vulnerability is fixed in Firefox 148 and Thunderbird 148.
Affected products
- Mozilla Firefox < 148
- Mozilla Thunderbird < 148
Timeline
- 2026-02-24: disclosed
- 2026-02-24: patched: Fixed in Firefox 148 and Thunderbird 148
- 2026-02-24: advisory
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2014136
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://access.redhat.com/security/cve/CVE-2026-2798
- https://bugzilla.redhat.com/show_bug.cgi?id=2442315
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2798.json