Cyber Resilience

CVE-2026-2798

HighUpdated

Published: 24 February 2026

Published
24 February 2026
Modified
30 June 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0025 15.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-2798 is a high-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-5 (Security Alerts, Advisories, and Directives).

Deeper analysis

CVE-2026-2798 is a use-after-free vulnerability (CWE-416) in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. Published on 2026-02-24, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact. The flaw was addressed in Firefox version 148 and Thunderbird version 148.

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though user interaction—such as visiting a malicious webpage—is necessary. Successful exploitation could allow attackers to achieve high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution within the browser's rendering engine.

Mozilla's security advisories MFSA2026-13 and MFSA2026-16, along with Bugzilla entry 2014136, provide details on the vulnerability and its resolution. Mitigation requires updating affected systems to Firefox 148 or Thunderbird 148, or higher, to apply the necessary patches.

EU & UK References

Vulnerability details

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free in browser DOM enables remote arbitrary code execution via malicious webpage visit, directly mapping to drive-by compromise and client-side exploitation techniques.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-2795Same product: Mozilla Firefox
CVE-2026-2764Same product: Mozilla Firefox
CVE-2025-1010Same product: Mozilla Firefox
CVE-2026-0882Same product: Mozilla Firefox
CVE-2026-2769Same product: Mozilla Firefox
CVE-2026-2799Same product: Mozilla Firefox
CVE-2026-2786Same product: Mozilla Firefox
CVE-2026-2766Same product: Mozilla Firefox
CVE-2026-2772Same product: Mozilla Firefox
CVE-2026-2770Same product: Mozilla Firefox

Affected Assets

mozilla
firefox
≤ 148.0
mozilla
thunderbird
≤ 148.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely remediation of the use-after-free flaw through patching to Firefox/Thunderbird 148 or higher.

prevent

Ensures receipt and dissemination of vendor advisories like MFSA2026-13 specifying patches for CVE-2026-2798.

detect

Vulnerability scanning detects outdated Firefox/Thunderbird versions vulnerable to this DOM use-after-free exploitation.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 8 (1 rule)
  • V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 9 (1 rule)
  • V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416

References