CVE-2026-2794
Published: 24 February 2026
Summary
CVE-2026-2794 is a high-severity Use of Uninitialized Resource (CWE-908) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 13.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the uninitialized memory disclosure by requiring timely patching to Firefox version 148 or later where the flaw is remediated.
Implements memory protection mechanisms that prevent unauthorized disclosure of sensitive data from uninitialized memory regions exploited in this CVE.
Enables detection of the specific vulnerability in deployed Firefox instances through regular scanning, prompting remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Uninitialized memory disclosure in browser process directly enables reading of in-memory sensitive data such as session cookies, auth tokens and credentials, facilitating browser session hijacking, web session cookie theft and credential harvesting from browsers.
NVD Description
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148.
Deeper analysisAI
CVE-2026-2794 is an information disclosure vulnerability stemming from uninitialized memory, classified under CWE-908. It affects Firefox and Firefox Focus for Android browsers. The issue was addressed in Firefox version 148, with the CVE published on 2026-02-24.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable remotely over the network with low complexity, no required privileges, and no user interaction. Attackers can achieve high-impact confidentiality violations, such as leaking sensitive data from memory, while integrity and availability remain unaffected.
Mozilla's security advisory MFSA2026-13 and Bugzilla bug 2008365 provide further details on the flaw. Mitigation requires updating to Firefox 148 or later versions where the vulnerability has been patched.
Details
- CWE(s)