CVE-2026-2772: Critical Media Playback Flaw in Firefox

CVE-2026-2772 is a critical flaw in Firefox and Thunderbird, scored 9.8 in the NVD record. It is a use-after-free in the Audio/Video: Playback component. Mozilla fixed it in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148 and Thunderbird 140.8. Update your browsers and mail clients to those releases or later.

What's affected

The record says this issue was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148 and Thunderbird 140.8. Anything older is affected. The advisories list fixes in Firefox ESR 115.33 as well as ESR 140.8.

For the upstream detail, Mozilla tracks it as Bug 2014827 and covers it in the security advisories for Firefox, Firefox ESR and Thunderbird.

Thunderbird needs a note. Mozilla says that, in general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potentially risks in browser or browser like contexts. Update it anyway.

The Mozilla advisories rate the impact as high and name the Audio/Video: Playback component. The record scores 9.8, which is critical, with a network attack vector and no privileges required. The record does not say this CVE is exploited, and the CISA KEV flag is false.

How to check if you're exposed

Check the version on every machine that runs Firefox or Thunderbird.

• In Firefox, open Help, then About Firefox. In Thunderbird, open Help, then About Thunderbird.
• From a shell, run firefox --version or thunderbird --version.
• On Debian or Ubuntu use dpkg-query -W firefox, on RPM systems rpm -q firefox, and on Windows winget list Mozilla.Firefox.

Compare the result against the fixed releases above. Remember kiosks, shared lab machines and virtual desktop images, which tend to lag behind. This is installed software and not an application dependency, so a dependency scan will not report it, but the Gold entry for the CVE lets you follow it.

What to do now

1. Update Firefox to 148 or later, or Firefox ESR to 140.8 or 115.33 or later, on every managed device.
2. Update Thunderbird to 148 or 140.8 or later.
3. Restart the application, since the old build keeps running until you do.
4. Check enterprise software deployment tools and package mirrors for the new versions.
5. Keep automatic updates on for unmanaged users, and report machines that block them.
6. Remove or isolate browsers that cannot be updated.

Why it matters

A use-after-free happens when code keeps using memory after it has been released. If an attacker can arrange for that memory to be reused, the stale reference can read or change data it should not touch. Here the Mozilla title is "Use-after-free in the Audio/Video: Playback component", and the record lists CWE-416.

Browsers parse and run untrusted content all day, which makes them a common first stop for attackers. Mozilla fixed many such flaws in this one release cycle, which is normal for a major browser update and a good reason not to defer it.

The practical advice is to measure how quickly updates reach every device, not just whether they exist.

Quick check

Sources

• Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
• Advisory 2026-14 (Firefox ESR 115.33)
• Advisory 2026-15 (Firefox ESR 140.8)
• Advisory 2026-16 (Thunderbird 148)
• Advisory 2026-17 (Thunderbird 140.8)

Last reviewed: 19 October 2026.