CVE-2026-2805

The vulnerability is classified as CWE-824 (Access of Uninitialized Pointer), meaning that the browser engine or email client references a pointer that was not properly initialized during DOM object processing. An improper operation on such a pointer can lead to memory corruption. A network attack vector with no privilege or user interaction requirements indicates that processing malicious content alone (e.g., a web page or HTML message) can trigger the error.

An attacker can gain full control over system confidentiality, integrity, and availability — in practice, this may mean remote execution of arbitrary code (RCE) in the context of a browser or email client process.

Mozilla Firefox should be immediately updated to version 148 and Mozilla Thunderbird to version 148, in which the vulnerability has been fixed. Details are available in the vendor's security advisories: mfsa2026-13 (Firefox) and mfsa2026-16 (Thunderbird).

Mozilla Firefox in versions prior to 148 and Mozilla Thunderbird in versions prior to 148.