CVE-2026-2757 is a critical security vulnerability in Mozilla Firefox's WebRTC Audio/Video component caused by incorrect boundary conditions. This vulnerability allows an attacker to potentially cause high impact on confidentiality, integrity, and availability of the affected system. It has a CVSS v3.1 base score of 9.8, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and impacts all three security properties at a high level. Mozilla fixed this vulnerability in Firefox 148 and Firefox ESR 115.33, as documented in their security advisories MFSA 2026-13 and MFSA 2026-14.

The vulnerability allows remote attackers to exploit incorrect boundary conditions in the WebRTC Audio/Video component, potentially leading to full compromise of confidentiality, integrity, and availability of the Firefox browser environment. This could enable arbitrary code execution or other severe consequences. However, no known exploits in the wild have been reported at the time of disclosure.

Official patches addressing CVE-2026-2757 are available in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these or later versions to remediate the vulnerability. Since this is a client-side application, applying the vendor's official updates is the recommended and effective mitigation. There is no indication from the vendor advisory that any additional or temporary mitigations are required.