CVE-2026-2772 is a use-after-free vulnerability (CWE-416) affecting the Audio/Video playback component in Mozilla Firefox. This type of vulnerability occurs when the software continues to use memory after it has been freed, potentially leading to memory corruption and arbitrary code execution. The vulnerability was assigned a CVSS v3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Mozilla addressed this vulnerability in Firefox 148 and Firefox ESR 115.33, as documented in their security advisories MFSA 2026-13 and MFSA 2026-14.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code, causing complete compromise of the affected Firefox browser instance. The high CVSS score indicates severe impact on confidentiality, integrity, and availability of the system running the vulnerable software. However, no known exploits in the wild have been reported as of the advisory date.

This vulnerability has been fixed by Mozilla in Firefox 148 and Firefox ESR 115.33. Users and organizations should update to these versions or later to remediate the issue. The vendor advisory explicitly states the fix availability, so applying the official update is the recommended mitigation. No additional action is required beyond updating to the patched versions.