CVE-2026-2791 is a mitigation bypass vulnerability affecting the Networking: Cache component in Mozilla Firefox. This flaw could allow an attacker to circumvent security mitigations, potentially leading to compromise of confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 148 and Firefox ESR 140.8. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on all security objectives. The vendor advisory confirms the fix is available and recommends upgrading to the specified versions.

The vulnerability allows bypassing of mitigation controls in the Networking: Cache component, which could lead to full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score of 9.8, successful exploitation could enable remote attackers to execute arbitrary code or cause denial of service without any user interaction or privileges. However, no active exploitation in the wild has been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should update their Firefox installations to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches.