CVE-2026-2798
Published: 24 February 2026
Summary
CVE-2026-2798 is a high-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 16.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-5 (Security Alerts, Advisories, and Directives).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of the use-after-free flaw through patching to Firefox/Thunderbird 148 or higher.
Ensures receipt and dissemination of vendor advisories like MFSA2026-13 specifying patches for CVE-2026-2798.
Vulnerability scanning detects outdated Firefox/Thunderbird versions vulnerable to this DOM use-after-free exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in browser DOM enables remote arbitrary code execution via malicious webpage visit, directly mapping to drive-by compromise and client-side exploitation techniques.
NVD Description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Deeper analysisAI
CVE-2026-2798 is a use-after-free vulnerability (CWE-416) in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. Published on 2026-02-24, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact. The flaw was addressed in Firefox version 148 and Thunderbird version 148.
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though user interaction—such as visiting a malicious webpage—is necessary. Successful exploitation could allow attackers to achieve high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution within the browser's rendering engine.
Mozilla's security advisories MFSA2026-13 and MFSA2026-16, along with Bugzilla entry 2014136, provide details on the vulnerability and its resolution. Mitigation requires updating affected systems to Firefox 148 or Thunderbird 148, or higher, to apply the necessary patches.
Details
- CWE(s)