CVE-2026-2799 is a use-after-free in the DOM: Core and HTML component of Firefox and Thunderbird. NVD scores it 9.8 (Critical) and Mozilla rates the impact high. Mozilla fixed it in Firefox 148 and Thunderbird 148 on 24 February 2026, so update both and restart.
What's affected
The record names Firefox and Thunderbird, fixed in Firefox 148 and Thunderbird 148. Mozilla lists the Firefox fix in MFSA 2026-13 and the Thunderbird fix in MFSA 2026-16. Earlier versions should be treated as affected.
Mozilla's Thunderbird advisory adds a useful note: in general these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potential risks in browser or browser-like contexts. Update anyway, since the fix ships in the same release.
The component is the DOM, the browser's in-memory model of a page. That means ordinary page content reaches the affected code, which is part of why the rating is high.
How to check if you're exposed
Check the version number first.
- Firefox: open the menu, choose Help, then About Firefox. On Linux you can also run the command below.
- Thunderbird: open the menu, choose Help, then About Thunderbird.
firefox --version
Anything below 148 is in scope. If a package manager or an enterprise policy controls updates on your machines, check the installed package version there as well, because a browser that has not restarted since an update can still be running old code.
What to do now
- Update Firefox to 148 or later.
- Update Thunderbird to 148 or later.
- Restart both applications so the new version is the one running.
- Verify the version on a sample of managed machines.
- If you embed either product in an image or an appliance, rebuild with the fixed release.
Why it matters
This is another instance of CWE-416 (Use After Free), in the code that builds and manipulates the page tree. A page's structure changes constantly as scripts add, move and delete nodes, so the engine has to track which objects are still alive. A mistake in that tracking can leave a pointer to freed memory.
Mozilla's advisory describes the bug only by component and class, and this post does the same. The practical point is simple. DOM code runs for every page you visit, so the safest response is to stay on the current release.
The record does not flag this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list. Patch on a high priority schedule.
Quick check
Which versions fix CVE-2026-2799?
Firefox 148 and Thunderbird 148, according to the NVD record and the Mozilla advisories.
Do I need to do anything beyond updating?
Restart the application. Mozilla's advisory lists no workaround, so the update is the fix.
Sources
- Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
- Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)
- Red Hat CVE page for CVE-2026-2799
Last reviewed: 19 October 2026.
