CVE-2026-2764 describes a use-after-free vulnerability combined with JIT miscompilation in the JavaScript Engine's JIT component of Mozilla Firefox. This memory safety issue could allow an attacker to execute arbitrary code with no privileges required and no user interaction needed. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Mozilla fixed this vulnerability in Firefox 148 and corresponding ESR and Thunderbird versions. The fix is officially released and publicly documented in Mozilla security advisories MFSA 2026-13 and MFSA 2026-14.

The vulnerability allows remote attackers to potentially execute arbitrary code on affected systems due to a use-after-free condition and JIT miscompilation in the JavaScript Engine. This can compromise confidentiality, integrity, and availability of the affected browser environment. The CVSS score of 9.8 reflects critical impact with no privileges or user interaction required. There are no known exploits in the wild at the time of disclosure, but the potential for exploitation is high given the nature of the flaw.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should upgrade to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisory.