CVE-2026-2771 is a critical memory safety vulnerability in the DOM: Core & HTML component of Mozilla Firefox, characterized by undefined behavior. It affects all Firefox versions prior to 148 and Firefox ESR versions prior to 115.33. The vulnerability was addressed and fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The Mozilla advisories confirm the fix and recommend updating to these versions. There are no confirmed exploits in the wild at this time.

Successful exploitation of this vulnerability could lead to complete compromise of confidentiality, integrity, and availability of the affected Firefox browser. The undefined behavior in the DOM: Core & HTML component may allow an attacker to execute arbitrary code or cause a denial of service. The CVSS score of 9.8 indicates critical impact. However, no known active exploits have been reported.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. Patch status is confirmed by the vendor advisories. No additional mitigation actions are indicated beyond applying the official updates.