CVE-2026-2763 is a use-after-free vulnerability (CWE-416) in the JavaScript Engine component of Mozilla Firefox. It has a CVSS v3.1 base score of 9.8 (critical) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level. The issue was reported by multiple researchers and fixed in Firefox 148 and Firefox ESR 115.33, among other products. The vendor advisory confirms the fix and groups this vulnerability with other high-impact memory safety bugs resolved in these versions.

Successful exploitation of this use-after-free vulnerability could lead to arbitrary code execution, resulting in full compromise of the affected Firefox or Thunderbird application. The CVSS score indicates critical severity with high impact on confidentiality, integrity, and availability. However, no active exploitation has been observed in the wild as of the advisory date.

This vulnerability has been fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these or later versions to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.