CVE-2026-2793 encompasses several memory safety bugs affecting Mozilla Firefox and Thunderbird products, specifically Firefox ESR 115.32, ESR 140.7, Firefox 147, and Thunderbird 147. These bugs showed evidence of memory corruption, which could be exploited to execute arbitrary code. Mozilla released fixes for these vulnerabilities in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The vulnerabilities include use-after-free, incorrect boundary conditions, integer overflows, JIT miscompilation, sandbox escapes, and other memory safety issues across various components such as JavaScript engine, graphics, audio/video, DOM, and networking. The Mozilla advisories MFSA 2026-13 and MFSA 2026-14 provide detailed references and confirm the fixes.

The vulnerabilities have a critical impact with a CVSS score of 9.8, indicating they can be exploited remotely without privileges or user interaction to achieve complete confidentiality, integrity, and availability compromise. Exploitation could lead to arbitrary code execution, sandbox escapes, privilege escalation, and information disclosure within affected Firefox and Thunderbird versions.

Official fixes are available and have been released by Mozilla. Users and administrators should update to Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8 to remediate these vulnerabilities. No additional mitigation actions are required beyond applying these updates.