CVE-2026-2794 is an information disclosure vulnerability due to uninitialized memory in Mozilla Firefox and Firefox Focus for Android. This vulnerability allows potential exposure of sensitive data from memory that was not properly initialized before use. The issue affects all Firefox versions prior to 148 and was resolved in Firefox 148. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating it can be exploited remotely over the network without privileges but requires user interaction. The vendor advisory from Mozilla confirms the fix in Firefox 148. There are no known exploits in the wild at this time.

Successful exploitation of this vulnerability could lead to disclosure of sensitive information from uninitialized memory in Firefox and Firefox Focus for Android. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability requires user interaction to exploit and can be triggered remotely without privileges.

Mozilla has released an official fix for this vulnerability in Firefox version 148. Users and administrators should update affected Firefox installations to version 148 or later to remediate this issue. No additional mitigation steps are required beyond applying the official update.