CVE-2026-2775 is a mitigation bypass vulnerability in the DOM: HTML Parser component of Mozilla Firefox. This flaw could allow attackers to bypass security mitigations, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 148 and Firefox ESR 115.33. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and can cause complete compromise. The vendor advisory confirms the fix and lists this vulnerability among multiple high-impact security issues addressed in the same release.

The vulnerability allows an attacker to bypass security mitigations in the HTML parser, which could lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and denial of service. The CVSS score of 9.8 reflects critical severity with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of advisory.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 115.33. Users and administrators should update affected Firefox installations to version 148 or later, or Firefox ESR 115.33 or later, to remediate this issue. Since this is not a cloud service, manual patching is required. There are no vendor indications that no action is required or that the issue is already mitigated without patching.