CVE-2026-2786
CriticalSummary
CVE-2026-2786 involves a use-after-free vulnerability in the JavaScript Engine component. It has been fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized memory access, potentially resulting in data leakage or execution of malicious code.
Recommendation
It is recommended to update to the latest versions of Firefox and Thunderbird to mitigate the risks associated with this vulnerability.
Other vulnerabilities in JavaScript Engine
See all- CVE-2026-2763Critical
A use-after-free vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. It is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CVE-2026-94448Low risk· EPSS 7%
When a JavaScript template literal contains consecutive expressions, context tracking state was not properly reset upon entering a new expression. Now template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
- CVE-2026-8391Medium
An unspecified vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. The flaw is fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Original NVD description (English source)
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS