CVE-2026-2797 is a use-after-free vulnerability in the JavaScript GC component of Mozilla Firefox, reported by multiple researchers including Evyatar Ben Asher and others. The flaw allows for memory corruption due to use-after-free conditions, which can lead to high impact outcomes such as arbitrary code execution or denial of service. This vulnerability was fixed in Firefox 148 and Thunderbird 148. The Mozilla Foundation Security Advisories MFSA2026-13 and MFSA2026-16 provide detailed information on this and related vulnerabilities, confirming the high impact and the availability of patches.

The vulnerability allows for use-after-free exploitation in the JavaScript GC component, which can lead to high impact consequences including arbitrary code execution, information disclosure, and denial of service. The CVSS 3.1 score of 8.8 reflects the critical nature of the vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Thunderbird 148. Users and administrators should update affected products to these versions or later to mitigate the risk. Since this is a client-side vulnerability, applying the official patches is the recommended and effective mitigation. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.