CVE-2026-2796 is a critical flaw (CVSS 9.8) in the JavaScript: WebAssembly component of Firefox and Thunderbird. Mozilla announced the fix on 24 February 2026 in Firefox 148 and Thunderbird 148. Update to those releases or later. The record does not mark it as a CISA Known Exploited Vulnerability.
What's affected
Firefox and Thunderbird builds older than the fixed releases. Mozilla fixed this issue in Firefox 148 and Thunderbird 148.
NVD scores it 9.8 (Critical). Mozilla's own advisory rates the issue high. Both numbers are worth knowing: the NVD vector assumes a network attack with no privileges, while the vendor rating reflects how Mozilla weighs it for a browser.
The record lists only the rapid release channel for the fix, Firefox 148 and Thunderbird 148. It does not list an ESR fix, so check the advisory for the ESR branch you run.
How to check if you're exposed
Check the version you run against the fixed releases.
- Firefox: open the menu, choose Help, then About Firefox. The dialog shows the version and checks for an update.
- Thunderbird: open Help, then About Thunderbird.
From a terminal, on systems where the binaries are on your path:
firefox --version
thunderbird --version
Linux distributions often ship fixes under their own package versions. If you install from a distribution repository, check your distributor's security notice for this CVE instead of comparing version numbers by eye. In a managed fleet, look at your software inventory for Firefox and Thunderbird builds below the fixed releases.
What to do now
- Update Firefox and Thunderbird to version 148 or later.
- On managed desktops, push the update through your normal software deployment tool and confirm the installed versions afterwards.
- Restart both applications. A browser that has downloaded an update keeps running the old code until it restarts.
- Check the advisory for your exact branch if you run an ESR or a distribution package.
Why it matters
A JIT compiler turns hot JavaScript or WebAssembly into machine code on the fly. A miscompilation means the generated code does not match what the source meant, and NVD files this one under CWE-843 (Access of Resource Using Incompatible Type (Type Confusion)), a type confusion. Mozilla's advisory names the component and does not describe the mechanism.
Browsers and mail clients process content from outside your organisation all day, so a fix in either is worth rolling out quickly even when the vendor's rating is lower than the NVD score.
Quick check
Is CVE-2026-2796 being exploited?
The record does not mark it as a CISA Known Exploited Vulnerability, and the Mozilla advisories we read do not describe attacks against it. That can change, so check the Gold page for CVE-2026-2796 when you plan the rollout.
Sources
- Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
- Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)
Last reviewed: 19 October 2026.
