CVE-2026-2796

CriticalCVSS 9.8

Published: 24/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

46th percentile - higher than 46% of all known CVEs

Summary

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of Firefox and Thunderbird. This flaw was fixed in versions 148 of both products.

Risk Assessment

The organization faces potential execution of incorrect code in the WebAssembly environment, which could allow an attacker to compromise data integrity or perform unauthorized operations.

Recommendation

Immediately update Firefox and Thunderbird to version 148 or later to remediate the vulnerability.

Original NVD description (English source)

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.