CVE-2026-2807 encompasses a set of memory safety bugs in Mozilla Firefox 147 and Thunderbird 147, including use-after-free, integer overflow, incorrect boundary conditions, sandbox escapes, and JIT miscompilations across various components such as JavaScript engine, WebRender, DOM, Audio/Video, and Storage. These bugs present a high impact risk, potentially allowing arbitrary code execution and privilege escalation. Mozilla fixed these vulnerabilities in Firefox 148 and Thunderbird 148. The Thunderbird product is less exposed to exploitation via email due to disabled scripting in mail reading contexts. The vendor advisory details multiple related CVEs with high impact and references to bug reports. No known exploits in the wild have been reported.

Successful exploitation of these memory safety vulnerabilities could allow attackers to execute arbitrary code, escape sandbox restrictions, escalate privileges, and cause denial of service. The vulnerabilities affect confidentiality, integrity, and availability of the affected products. Thunderbird is less susceptible to exploitation via email due to disabled scripting when reading mail, but risks remain in browser-like contexts.

Mozilla has released official fixes in Firefox 148 and Thunderbird 148. Users and administrators should update to these versions or later to remediate the vulnerabilities. No additional mitigation actions are required beyond applying the official updates.