CVE-2026-2757
Mozilla Firefox ≤ 115.33.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-2757 is a critical-severity Improper Handling of Physical or Environmental Conditions (CWE-1384) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CP-12 (Safe Mode) and PE-13 (Fire Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-2757 is a high-severity vulnerability stemming from incorrect boundary conditions in the WebRTC Audio/Video component of Mozilla products. It affects Firefox versions prior to 148, Firefox ESR versions prior to 115.33 and 140.8, Thunderbird versions prior to 148, and Thunderbird versions prior to 140.8. The issue is cataloged under CWE-1384 with an additional NVD-CWE-noinfo mapping and carries a CVSS v3.1 base score of 9.8.
The vulnerability enables exploitation over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and without changing scope (S:U). Remote attackers can thus achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially leading to full system compromise such as arbitrary code execution via malicious WebRTC traffic.
Mozilla's security advisories (MFSA 2026-13 through 2026-16) and the associated Bugzilla entry (bug 2001637) detail the fix applied in the listed versions. Security practitioners should prioritize updating affected Firefox and Thunderbird installations to the patched releases to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8478
Vulnerability Data
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
EMP protection directly addresses an artificially induced physical/environmental threat.
Safe-mode entry on detected adverse conditions reduces impact without eliminating the root handling weakness.
Fire detection and suppression directly stops fire (an environmental condition) from damaging the system.
Maintaining temperature and humidity levels prevents environmental conditions from affecting system operation.
Isolation valves and shutoffs stop water damage (environmental condition) from reaching the system.
Known-state failure on component or environmental faults limits blast radius.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit protection of assets from environmental threats is the core mitigation for improper handling of those conditions.
Monitoring the physical environment directly surfaces the conditions the weakness fails to handle.
Resilience mechanisms help withstand adverse environmental situations but do not specifically address detection or handling of the conditions themselves.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires protection against physical and environmental threats that the weakness describes.
Ensures supporting utilities (power, HVAC) are protected, mitigating environmental-condition failures.
Physical security monitoring can detect environmental anomalies or tampering.
Ensures information security is maintained during physical or environmental disruptions.
ICT readiness for business continuity includes resilience to environmental conditions.
Physical perimeters reduce exposure to external environmental threats.