CVE-2026-2797 is a use-after-free in the JavaScript garbage collector (GC) component of Firefox and Thunderbird. NVD scores it 9.8 (Critical), and Mozilla rates its impact high. The fix shipped in Firefox 148 and Thunderbird 148 on 24 February 2026. Update both products to 148 or later and restart them.
What's affected
Per the NVD record and Mozilla's advisories, the flaw is in the JavaScript: GC component and was fixed in Firefox 148 and Thunderbird 148. Earlier releases should be treated as affected. Mozilla published the Firefox fix in MFSA 2026-13 and the Thunderbird fix in MFSA 2026-16.
Mozilla's Thunderbird advisory adds a useful note: in general these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potential risks in browser or browser-like contexts. Update anyway, since the fix ships in the same release.
The advisories are for the standard Firefox release and Thunderbird. If you run an Extended Support Release or a build from a Linux distribution, read the advisory and your vendor's notice to confirm which version carries the fix. I did not confirm ESR version numbers from the sources used here.
How to check if you're exposed
Check the version number first.
- Firefox: open the menu, choose Help, then About Firefox. On Linux you can also run the command below.
- Thunderbird: open the menu, choose Help, then About Thunderbird.
firefox --version
Anything below 148 is in scope. If a package manager or an enterprise policy controls updates on your machines, check the installed package version there as well, because a browser that has not restarted since an update can still be running old code.
What to do now
- Update Firefox to 148 or later through the built-in updater, your package manager or your software deployment tool.
- Update Thunderbird to 148 or later the same way.
- Restart both applications. An update does not protect a session that is still running the old binary.
- On managed fleets, confirm the installed version on a sample of machines rather than trusting the deployment report.
- If you ship Firefox or Thunderbird inside a product or an image, rebuild with the fixed version and re-scan.
Why it matters
The weakness class is CWE-416 (Use After Free). A garbage collector decides when memory that scripts no longer use can be reclaimed. If the engine keeps a reference to memory after it has been freed, a later use of that reference touches memory that may now hold something else. Browsers treat this class as serious because web content can influence the timing and layout of memory, so Mozilla and NVD both place it at the high end.
The CVSS vector is network, low complexity, no privileges and no user interaction in the NVD scoring, which is why the number is 9.8. In practice a browser flaw like this still needs the victim to load hostile content, and the browser sandbox adds a second barrier. That is no reason to wait. Browsers are updated often, and the fix is a normal version bump.
NVD does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and the Mozilla advisory does not report exploitation. Treat it as a high priority patch, not as an active incident.
Quick check
Is CVE-2026-2797 being exploited in the wild?
Not according to the sources reviewed. It is not on the CISA Known Exploited Vulnerabilities list and Mozilla's advisory does not mention exploitation. Patch on your normal fast browser cadence.
Does reading email in Thunderbird expose me?
Mozilla says these flaws generally cannot be triggered through email in Thunderbird because scripting is disabled when reading mail. Browser-like contexts are the risk. Update regardless.
Sources
- Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
- Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)
- Red Hat CVE page for CVE-2026-2797
Last reviewed: 19 October 2026.
