CVE-2026-2775

CriticalCVSS 9.8

Published: 24/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

42th percentile - higher than 42% of all known CVEs

Summary

A mitigation bypass vulnerability exists in the DOM: HTML Parser component of Firefox and Thunderbird. The flaw was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Risk Assessment

An attacker could exploit this vulnerability to bypass browser security mechanisms, potentially leading to unauthorized operations on a web page or email.

Recommendation

Immediately update Firefox and Thunderbird to the patched versions listed (Firefox 148, Firefox ESR 115.33/140.8, Thunderbird 148/140.8).

Original NVD description (English source)

Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.