CVE-2026-2805 is a use-after-free vulnerability categorized under CWE-824, occurring due to an invalid pointer in the DOM: Core & HTML component of Mozilla Firefox. It has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability at a high level. This vulnerability was fixed in Firefox 148 as part of a large batch of security fixes addressing multiple high-impact issues across Firefox and Thunderbird products.

Successful exploitation of CVE-2026-2805 could allow an attacker to execute arbitrary code or cause a denial of service, resulting in full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score and the nature of the vulnerability (invalid pointer leading to use-after-free), the impact is severe. However, no known exploits were reported in the wild at the time of disclosure.

Mozilla has released an official fix for this vulnerability in Firefox 148. Users and administrators should update affected Firefox installations to version 148 or later to remediate this issue. For Thunderbird users, updating to Thunderbird 148 or later is also recommended. No additional mitigation steps are required beyond applying the official update.