CVE-2026-2764
Published: 24 February 2026
Summary
CVE-2026-2764 is a critical-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 37.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-2764 is a high-severity vulnerability involving JIT miscompilation that leads to a use-after-free condition in the JavaScript Engine's JIT component. It affects Mozilla Firefox and Thunderbird prior to the following fixed versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Classified under CWE-416 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw enables severe impacts without requiring user privileges or interaction.
Remote attackers can exploit this vulnerability over the network with low complexity by delivering malicious web content that triggers the JIT miscompilation and use-after-free error. No authentication or user interaction is needed, allowing unauthenticated adversaries to achieve high confidentiality, integrity, and availability impacts, potentially resulting in arbitrary code execution within the browser's sandboxed environment.
Mozilla's security advisories (MFSA 2026-13 through 2026-16) and the associated Bugzilla entry (bug 2012608) confirm the issue was addressed in the listed patches. Security practitioners should prioritize updating affected Firefox and Thunderbird installations to the fixed versions to mitigate exploitation risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8486
Vulnerability details
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote arbitrary code execution via malicious web/JS content with no auth/UI required, directly mapping to drive-by compromise via crafted sites and exploitation for client execution in browser/email clients.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, prioritization, and patching of the JIT miscompilation use-after-free flaw in vulnerable Firefox and Thunderbird versions to eliminate remote code execution risk.
Ensures reception and implementation of vendor security advisories like MFSA 2026-13 announcing CVE-2026-2764, prompting updates to fixed versions.
Deploys vulnerability scanning to identify systems running affected Firefox or Thunderbird versions prior to exploitation via malicious web content.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 8 (1 rule)
- V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 9 (1 rule)
- V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416