CVE-2026-2787 is a use-after-free vulnerability classified under CWE-416 affecting the DOM Window and Location component in Mozilla Firefox. Use-after-free vulnerabilities occur when a program continues to use a pointer after the memory it points to has been freed, which can lead to memory corruption and potentially arbitrary code execution. This vulnerability was addressed and fixed in Firefox 148 and corresponding ESR and Thunderbird versions. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges and requires user interaction, with high impact on confidentiality, integrity, and availability.

The vulnerability allows an attacker to exploit a use-after-free condition in the DOM Window and Location component, which can lead to memory corruption. This may enable arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical nature of the impact if exploited. However, there are no known exploits in the wild at the time of publication.

A fix is available and has been officially released by Mozilla. Users and administrators should update to Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8 to remediate this vulnerability. No additional mitigation actions are required beyond applying these updates.