CVE-2026-2775 is a mitigation bypass vulnerability located in the DOM: HTML Parser component of Mozilla Firefox. The issue allows bypassing of security mitigations, which could lead to severe consequences including arbitrary code execution or other high-impact outcomes. Mozilla has addressed this vulnerability in Firefox 148 and corresponding ESR and Thunderbird versions. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix availability and recommends upgrading to the patched versions.

The vulnerability allows an attacker to bypass mitigation controls in the HTML parser of the DOM, which can lead to full compromise of the affected Firefox browser, including arbitrary code execution, data disclosure, and denial of service. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigations are indicated by the vendor advisory.