CVE-2026-2798 is a use-after-free vulnerability identified in the DOM Core & HTML component of Mozilla Firefox. Use-after-free vulnerabilities occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or application crashes. This vulnerability was addressed and fixed in Firefox version 148. The vulnerability carries a CVSS v3.1 score of 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impacts. The vendor advisory from Mozilla confirms the fix in Firefox 148 and recommends updating to this version to mitigate the risk.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code within the context of the affected Firefox browser, potentially leading to full compromise of the user's browser environment. It may also cause denial of service by crashing the browser. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild at the time of the advisory.

Mozilla has released an official fix for this vulnerability in Firefox version 148. Users and administrators should update affected Firefox installations to version 148 or later to remediate this issue. No additional mitigation steps are required beyond applying the official update.