CVE-2026-2799

CriticalCVSS 9.8

Published: 24/02/2026(UTC)Updated: 30/06/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in versions 148 of both applications.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code remotely or cause application crashes, posing a serious risk to system confidentiality and availability.

Recommendation

Immediately update Firefox and Thunderbird to version 148 or later.

Original NVD description (English source)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.