CVE-2026-2795 is a use-after-free vulnerability classified under CWE-416 affecting the JavaScript garbage collection component in Mozilla Firefox. This vulnerability allows an attacker to use memory after it has been freed, potentially leading to arbitrary code execution or other severe impacts. The flaw was reported by researcher x0e and fixed in Firefox 148 and Thunderbird 148. The CVSS v3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating that the vulnerability is remotely exploitable over the network with low attack complexity, no privileges required, but requires user interaction. Successful exploitation can result in high confidentiality, integrity, and availability impacts. Mozilla has published official security advisories detailing the fix and encouraging users to update.

The vulnerability allows remote attackers to exploit a use-after-free condition in the JavaScript GC component, potentially leading to arbitrary code execution or other high-impact consequences such as complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 8.8 reflects the high severity and the significant risk posed by this flaw if exploited.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Thunderbird 148. Users and administrators should update affected products to these versions or later to remediate the vulnerability. No additional mitigation is required beyond applying the official patches. There are no known exploits in the wild at this time.