CVE-2026-2795 is a use-after-free vulnerability classified under CWE-416 affecting the JavaScript GC component in Mozilla Firefox. The vulnerability allows for potential memory corruption leading to high impact on confidentiality, integrity, and availability (CVSS 8.8). Mozilla fixed this issue in Firefox 148 and Thunderbird 148, as documented in their security advisories MFSA2026-13 and MFSA2026-16. The vulnerability was reported by researcher x0e and tracked under Bug 2010940. No known active exploitation has been reported.

The vulnerability has a high impact rating with a CVSS score of 8.8, indicating that successful exploitation could lead to complete compromise of confidentiality, integrity, and availability of the affected system. It could allow remote attackers to execute arbitrary code or cause application crashes. However, no known exploits in the wild have been reported, reducing immediate risk. The flaw affects Firefox and Thunderbird prior to version 148.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Thunderbird 148. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as fixed in the specified versions.