CVE-2026-2767 is a use-after-free vulnerability affecting the JavaScript WebAssembly component in Mozilla Firefox. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or crashes. This vulnerability was fixed in Firefox 148 and Firefox ESR 140.8, with corresponding fixes in Thunderbird. The CVSS 3.1 base score of 8.8 reflects its high impact and ease of exploitation requiring only user interaction. The Mozilla Foundation security advisories MFSA 2026-13 and MFSA 2026-15 provide detailed information on this and related vulnerabilities, confirming the fixes and the high impact rating.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code, cause a denial of service, or compromise the confidentiality and integrity of user data within Firefox. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of the advisory.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official updates.