CVE-2026-2796

The vulnerability consists of incorrect code compilation by the JIT engine during JavaScript/WebAssembly component processing — memory resources are read or written using an incompatible type (type confusion, CWE-843). An attacker can craft a malicious website or email message with embedded WebAssembly/JavaScript code, which when processed by the vulnerable engine leads to memory corruption. The vulnerability does not require user interaction beyond standard content opening, and exploitation can be performed remotely over the network.

Successful exploitation of this vulnerability may allow an attacker to gain full control over the browser or mail client process, including reading and modifying data as well as potential arbitrary code execution (RCE) in the context of the logged-in user.

Mozilla Firefox should be immediately updated to version 148 or later, and Mozilla Thunderbird should be updated to version 148 or later, in which the vulnerability has been patched. Details are available in Mozilla security advisories: mfsa2026-13 and mfsa2026-16.

Mozilla Firefox in versions prior to 148 and Mozilla Thunderbird in versions prior to 148.