CVE-2026-24869
Published: 27 January 2026
Summary
CVE-2026-24869 is a high-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 17.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the use-after-free vulnerability by requiring timely testing and installation of the vendor patch released in Firefox 147.0.2.
Implements memory protection mechanisms such as address space layout randomization, non-executable memory, and bounds checking that defend against use-after-free exploitation in the layout component.
Enables proactive identification of systems running vulnerable Firefox versions prior to 147.0.2 through regular vulnerability scanning.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in browser layout engine enables RCE via malicious webpage visit, directly mapping to drive-by compromise and exploitation for client execution.
NVD Description
Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.
Deeper analysisAI
CVE-2026-24869 is a use-after-free vulnerability (CWE-416) in the Layout: Scrolling and Overflow component of Mozilla Firefox. It affects versions of Firefox prior to 147.0.2 and was published on 2026-01-27T16:16:36.283.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Remote attackers with no privileges required can exploit it over the network with low complexity, but it requires user interaction, such as visiting a malicious webpage. Successful exploitation can result in high impacts to confidentiality, integrity, and availability.
Mozilla fixed this vulnerability in Firefox 147.0.2. Additional details are available in the Mozilla security advisory at https://www.mozilla.org/security/advisories/mfsa2026-06/ and the Bugzilla entry at https://bugzilla.mozilla.org/show_bug.cgi?id=2008698.
Details
- CWE(s)