CVE-2026-3847
Published: 10 March 2026
Summary
CVE-2026-3847 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 22.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3847 encompasses multiple memory safety bugs in Firefox 148.0.2, associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-416 (Use After Free). These bugs demonstrated evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution. The affected software is the Mozilla Firefox web browser at version 148.0.2.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity. Remote attackers require no privileges and can exploit it over the network with low complexity, but user interaction—such as visiting a malicious webpage—is necessary. Successful exploitation could grant high-impact access to confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the victim's system.
Mozilla addressed CVE-2026-3847 in Firefox 148.0.2. Security advisories recommend updating to this patched version. Additional details are available in Mozilla's security advisory MFSA 2026-19 at https://www.mozilla.org/security/advisories/mfsa2026-19/ and related Bugzilla entries (bugs 2017513, 2017622, 2019341) at https://bugzilla.mozilla.org/buglist.cgi?bug_id=2017513%2C2017622%2C2019341.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10506
Vulnerability details
Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox…
more
148.0.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption RCE in Firefox directly enables drive-by compromise via malicious webpage (T1189) and exploitation for client-side code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses CVE-2026-3847 by requiring identification, reporting, and correction of memory safety flaws through timely patching to Firefox 148.0.2.
Implements security safeguards such as address space layout randomization and data execution prevention to protect against memory corruption exploits from buffer overflows and use-after-free bugs in Firefox.
Enables scanning for known vulnerabilities like CVE-2026-3847 in deployed Firefox versions to identify and prioritize remediation.