Home

Description

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

PUBLISHED Reserved 2026-02-19 | Published 2026-02-24 | Updated 2026-05-10 | Assigner mozilla

Product status

140.8 (rpm)
unaffected

148 (rpm)
unaffected

140.8 (rpm)
unaffected

148 (rpm)
unaffected

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

References

bugzilla.mozilla.org/show_bug.cgi?id=2013612

www.mozilla.org/security/advisories/mfsa2026-13/

www.mozilla.org/security/advisories/mfsa2026-15/

www.mozilla.org/security/advisories/mfsa2026-16/

www.mozilla.org/security/advisories/mfsa2026-17/

cve.org (CVE-2026-2786)

nvd.nist.gov (CVE-2026-2786)

Download JSON