CVE-2026-2783
Published: 24 February 2026
Summary
CVE-2026-2783 is a high-severity Type Confusion (CWE-843) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the JIT miscompilation flaw by requiring timely identification, reporting, and patching of vulnerable Firefox and Thunderbird versions to the fixed releases.
Detects the presence of vulnerable software versions affected by CVE-2026-2783 through regular vulnerability scanning of systems running Firefox and Thunderbird.
Ensures awareness of Mozilla security advisories (MFSA 2026-13 et al.) detailing the vulnerability and required patches for affected products.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Info disclosure via JS engine memory leak directly enables collection of process data/credentials from browser without needing file access or separate dumping techniques.
NVD Description
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Deeper analysisAI
CVE-2026-2783 is an information disclosure vulnerability stemming from JIT miscompilation in the JavaScript Engine's JIT component. It affects Mozilla Firefox versions prior to 148, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird prior to 140.8. The issue is classified under CWE-843 (Access of Resource Using Incompatible Type) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to its potential for confidential data exposure.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables high-impact confidentiality violations, such as leaking sensitive memory contents from the JavaScript engine, potentially exposing user data, tokens, or other process information without affecting integrity or availability.
Mozilla's security advisories (MFSA 2026-13, 2026-15, 2026-16, and 2026-17) and Bugzilla entry 2010943 detail the fix applied in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Security practitioners should prioritize updating affected products to these versions or later to mitigate the risk.
Details
- CWE(s)