CVE-2026-2785

The bug consists of using an invalid (uninitialized or invalidated) pointer in the JavaScript engine component. Incorrect access to such a pointer can lead to memory corruption of the process. An attacker can provide specially crafted JavaScript code (e.g., through a malicious website or email message) that triggers this error.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code remotely (RCE) in the context of the application, as well as compromise the confidentiality, integrity, and availability of the system.

Update to Firefox 148, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8, in which the vulnerability has been fixed. Patches are available in the vendor references (mozilla.org/security/advisories).

Mozilla Firefox (versions prior to 148), Mozilla Firefox ESR (versions prior to 140.8), Mozilla Thunderbird (versions prior to 148), Mozilla Thunderbird ESR (versions prior to 140.8)