CVE-2026-2765 is a use-after-free vulnerability (CWE-416) in the JavaScript Engine component of Mozilla Firefox. This type of vulnerability occurs when the program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption and arbitrary code execution. The vulnerability was addressed and fixed in Firefox 148 and Firefox ESR 140.8 as part of a broader set of memory safety fixes. The CVSS v3.1 base score is 9.8, reflecting a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Mozilla's security advisories provide detailed references and confirm the remediation status.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely without any user interaction or privileges, compromising the confidentiality, integrity, and availability of the affected system. However, as of the advisory date, no exploits are known to be active in the wild. The vulnerability affects Firefox versions prior to 148 and Firefox ESR versions prior to 140.8.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should update affected Firefox installations to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official update.