CVE-2026-2783
Published: 24 February 2026
Summary
CVE-2026-2783 is a high-severity Type Confusion (CWE-843) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 20.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-2783 is an information disclosure vulnerability stemming from JIT miscompilation in the JavaScript Engine's JIT component. It affects Mozilla Firefox versions prior to 148, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird prior to 140.8. The issue is classified under CWE-843 (Access of Resource Using Incompatible Type) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to its potential for confidential data exposure.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables high-impact confidentiality violations, such as leaking sensitive memory contents from the JavaScript engine, potentially exposing user data, tokens, or other process information without affecting integrity or availability.
Mozilla's security advisories (MFSA 2026-13, 2026-15, 2026-16, and 2026-17) and Bugzilla entry 2010943 detail the fix applied in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Security practitioners should prioritize updating affected products to these versions or later to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8503
Vulnerability details
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Info disclosure via JS engine memory leak directly enables collection of process data/credentials from browser without needing file access or separate dumping techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the JIT miscompilation flaw by requiring timely identification, reporting, and patching of vulnerable Firefox and Thunderbird versions to the fixed releases.
Detects the presence of vulnerable software versions affected by CVE-2026-2783 through regular vulnerability scanning of systems running Firefox and Thunderbird.
Ensures awareness of Mozilla security advisories (MFSA 2026-13 et al.) detailing the vulnerability and required patches for affected products.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-200
Ubuntu 24.04 (2 rules)
- V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. via CWE-200
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-200
Windows 10 (1 rule)
- V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. via CWE-200
Windows Server 2016 (1 rule)
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
Windows Server 2019 (1 rule)
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
Windows Server 2022 (1 rule)
- V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200