CVE-2026-2803
Published: 24 February 2026
Summary
CVE-2026-2803 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 16.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AU-13 (Monitoring for Information Disclosure).
Deeper analysis
CVE-2026-2803 is an information disclosure and mitigation bypass vulnerability in the Settings UI component of Mozilla Firefox and Thunderbird. It affects versions of these products prior to Firefox 148 and Thunderbird 148, in which the issue was fixed. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-693 (Protection Mechanism Failure).
The vulnerability can be exploited by any remote, unauthenticated attacker with network access and low attack complexity, requiring no user interaction. Successful exploitation enables the attacker to obtain high-impact disclosure of sensitive information from the affected browser or email client while bypassing existing security mitigations.
Mozilla's security advisories MFSA 2026-13 and MFSA 2026-16, along with Bugzilla entry 2012012, detail the patch applied in Firefox 148 and Thunderbird 148. Security practitioners should prioritize updating affected instances to these versions or later to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8456
Vulnerability details
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Info disclosure + mitigation bypass in browser/email client Settings UI directly enables local data/credential harvesting from the affected application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of system flaws, directly requiring patches like Firefox 148 to remediate the information disclosure and mitigation bypass vulnerability.
Requires vulnerability scanning to identify systems running vulnerable versions of Firefox or Thunderbird affected by CVE-2026-2803.
Monitors for unauthorized disclosures of sensitive information, detecting exploitation of the Settings UI vulnerability.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (2 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-693
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-693
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-200
Ubuntu 24.04 (2 rules)
- V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. via CWE-200
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-200
Windows 10 (3 rules)
- V-220865 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
- V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. via CWE-200
- V-220812 Credential Guard must be running on Windows 10 domain-joined systems. via CWE-693
Windows 11 (1 rule)
- V-253418 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
Windows Server 2016 (2 rules)
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
- V-225012 Windows Server 2016 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2019 (2 rules)
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
- V-205907 Windows Server 2019 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2022 (2 rules)
- V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
- V-254441 Windows Server 2022 must be running Credential Guard on domain-joined member servers. via CWE-693