CVE-2026-0884
Published: 13 January 2026
Summary
CVE-2026-0884 is a critical-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 33.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0884 is a use-after-free vulnerability (CWE-416) in the JavaScript Engine component of Mozilla products. It affects Firefox versions prior to 147, Firefox ESR versions prior to 140.7, Thunderbird versions prior to 147, and Thunderbird versions prior to 140.7. The vulnerability was published on 2026-01-13 and carries a CVSS v3.1 base score of 9.8, indicating critical severity.
Remote attackers can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), without privileges (PR:N) or user interaction (UI:N), and with unchanged scope (S:U). Successful exploitation enables high-impact violations of confidentiality, integrity, and availability (C:H/I:H/A:H), potentially leading to arbitrary code execution within the context of the affected browser or mail client.
Mozilla has fixed the vulnerability in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Mitigation involves updating to these versions or later. Further details are provided in Mozilla Security Advisories MFSA 2026-01, MFSA 2026-03, MFSA 2026-04, MFSA 2026-05, and Bugzilla bug 2003588.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2341
Vulnerability details
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in JS engine directly enables remote arbitrary code execution on client (T1203: Exploitation for Client Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of known flaws like this use-after-free vulnerability through patching to updated Firefox and Thunderbird versions.
Implements memory protections such as non-executable memory and ASLR to prevent arbitrary code execution from use-after-free exploits in the JavaScript engine.
Enables vulnerability scanning to identify systems running vulnerable Firefox or Thunderbird versions affected by this CVE.