This vulnerability (CVE-2026-2764) affects the Just-In-Time (JIT) compiler component of the JavaScript Engine in Mozilla Firefox. It involves a use-after-free condition combined with JIT miscompilation, which can lead to memory corruption and potentially allow an attacker to execute arbitrary code. The issue was reported by multiple researchers and fixed in Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8. The CVSS v3.1 score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on affected systems without requiring user interaction or privileges. The high CVSS score reflects the critical nature of the flaw, which impacts confidentiality, integrity, and availability of the affected Firefox installations. No known exploits in the wild have been reported at the time of disclosure.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. Patch status is confirmed by the vendor advisory.