CVE-2026-2763
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A use-after-free vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. It is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code remotely or cause a denial of service, compromising user data confidentiality and integrity.
Recommendation
Immediately update Firefox and Thunderbird to the patched versions listed (Firefox 148, ESR 115.33/140.8, Thunderbird 148/140.8).
Other vulnerabilities in JavaScript Engine
See all- CVE-2026-2786Critical
CVE-2026-2786 involves a use-after-free vulnerability in the JavaScript Engine component. It has been fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CVE-2026-94448Low risk· EPSS 7%
When a JavaScript template literal contains consecutive expressions, context tracking state was not properly reset upon entering a new expression. Now template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
- CVE-2026-8391Medium
An unspecified vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. The flaw is fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Original NVD description (English source)
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS