CVE-2026-2758 is a use-after-free vulnerability in the JavaScript garbage collection component of Mozilla Firefox. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption and arbitrary code execution. This vulnerability was assigned a CVSS v3.1 base score of 9.8, reflecting its critical nature with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Mozilla fixed this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The vendor advisories provide detailed references to the bug report and confirm the fix status. No exploits in the wild have been reported.

The vulnerability allows an attacker to exploit a use-after-free condition in the JavaScript GC component, which can lead to arbitrary code execution with the privileges of the Firefox process. The CVSS score of 9.8 indicates critical impact affecting confidentiality, integrity, and availability. Successful exploitation could allow remote attackers to execute code without user interaction or privileges. However, no known exploits in the wild have been reported as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should upgrade to these versions or later to remediate this vulnerability. Since this is not a cloud service, patching client installations is required. There are no vendor advisories indicating that no action is required or that the issue is mitigated by other means. Patch status is confirmed by the vendor advisories.