CVE-2026-2798 is a use-after-free vulnerability classified under CWE-416 affecting the DOM: Core & HTML component in Mozilla Firefox. Use-after-free vulnerabilities occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or application crashes. This vulnerability was addressed and fixed in Firefox 148 and Thunderbird 148 as part of a broader set of high-impact security fixes. The CVSS 3.1 vector indicates it is remotely exploitable over the network without privileges and requires user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, cause a denial of service, or otherwise compromise the confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8. There are no known active exploits in the wild. In Thunderbird, the risk is mitigated by disabled scripting in email reading contexts, reducing the likelihood of exploitation via email.

Mozilla has released an official fix for CVE-2026-2798 in Firefox 148 and Thunderbird 148. Users and administrators should update affected products to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official updates.