CVE-2026-2798
Published: 24 February 2026
Summary
CVE-2026-2798 is a high-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-5 (Security Alerts, Advisories, and Directives).
Deeper analysis
CVE-2026-2798 is a use-after-free vulnerability (CWE-416) in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. Published on 2026-02-24, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact. The flaw was addressed in Firefox version 148 and Thunderbird version 148.
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though user interaction—such as visiting a malicious webpage—is necessary. Successful exploitation could allow attackers to achieve high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution within the browser's rendering engine.
Mozilla's security advisories MFSA2026-13 and MFSA2026-16, along with Bugzilla entry 2014136, provide details on the vulnerability and its resolution. Mitigation requires updating affected systems to Firefox 148 or Thunderbird 148, or higher, to apply the necessary patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8450
Vulnerability details
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in browser DOM enables remote arbitrary code execution via malicious webpage visit, directly mapping to drive-by compromise and client-side exploitation techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the use-after-free flaw through patching to Firefox/Thunderbird 148 or higher.
Ensures receipt and dissemination of vendor advisories like MFSA2026-13 specifying patches for CVE-2026-2798.
Vulnerability scanning detects outdated Firefox/Thunderbird versions vulnerable to this DOM use-after-free exploitation.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 8 (1 rule)
- V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 9 (1 rule)
- V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416