CVE-2026-2763 is a use-after-free vulnerability identified in the JavaScript Engine component of Mozilla Firefox. This type of vulnerability occurs when the software continues to use memory after it has been freed, potentially leading to memory corruption and arbitrary code execution. The vulnerability was reported by multiple researchers and fixed in Firefox 148 and corresponding ESR and Thunderbird versions. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The Mozilla advisories confirm the fix and classify the impact as high.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely without requiring user interaction or privileges. This can lead to full compromise of the affected Firefox browser and potentially the underlying system. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying these official updates.