CVE-2026-2765 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox. This type of vulnerability occurs when the software continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The issue was fixed in Firefox 148 and Firefox ESR 140.8. The Mozilla Foundation Security Advisories MFSA 2026-13 and MFSA 2026-15 provide detailed information on this and multiple related vulnerabilities, all fixed in these versions. The vendor advisory confirms the availability of official patches.

Successful exploitation of this use-after-free vulnerability could lead to arbitrary code execution, resulting in full compromise of the affected Firefox browser instance. The vulnerability impacts confidentiality, integrity, and availability of the system running the vulnerable Firefox version. Given the critical CVSS score and nature of the flaw, attackers could potentially execute malicious code remotely without any user interaction or privileges. However, there are no known exploits in the wild at the time of this advisory.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to mitigate the risk. No additional mitigation steps are required beyond applying the official patches.