CVE-2026-2771
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Undefined behavior was discovered in the DOM: Core & HTML component of Firefox and Thunderbird. The vulnerability has been fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Risk Assessment
Undefined behavior in the DOM can lead to unpredictable consequences, including potential code execution or application crashes, posing a risk to system stability and user security.
Recommendation
Immediately update Firefox to version 148 or later, and Thunderbird to version 148 or later. For ESR versions, apply Firefox ESR 115.33 or 140.8 and Thunderbird 140.8 accordingly.
Original NVD description (English source)
Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.