CVE-2026-2803
Published: 24 February 2026
Summary
CVE-2026-2803 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 18.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AU-13 (Monitoring for Information Disclosure).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and correction of system flaws, directly requiring patches like Firefox 148 to remediate the information disclosure and mitigation bypass vulnerability.
Requires vulnerability scanning to identify systems running vulnerable versions of Firefox or Thunderbird affected by CVE-2026-2803.
Monitors for unauthorized disclosures of sensitive information, detecting exploitation of the Settings UI vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Info disclosure + mitigation bypass in browser/email client Settings UI directly enables local data/credential harvesting from the affected application.
NVD Description
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Deeper analysisAI
CVE-2026-2803 is an information disclosure and mitigation bypass vulnerability in the Settings UI component of Mozilla Firefox and Thunderbird. It affects versions of these products prior to Firefox 148 and Thunderbird 148, in which the issue was fixed. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-693 (Protection Mechanism Failure).
The vulnerability can be exploited by any remote, unauthenticated attacker with network access and low attack complexity, requiring no user interaction. Successful exploitation enables the attacker to obtain high-impact disclosure of sensitive information from the affected browser or email client while bypassing existing security mitigations.
Mozilla's security advisories MFSA 2026-13 and MFSA 2026-16, along with Bugzilla entry 2012012, detail the patch applied in Firefox 148 and Thunderbird 148. Security practitioners should prioritize updating affected instances to these versions or later to mitigate the risk.
Details
- CWE(s)