CVE-2026-2807 covers memory safety bugs in Firefox 147 and Thunderbird 147. Mozilla says some showed evidence of memory corruption and presumes that with enough effort they could be exploited to run arbitrary code. NVD scores it 9.8 (Critical). Update to Firefox 148 and Thunderbird 148.
What's affected
Mozilla describes the entry as memory safety bugs present in Firefox 147 and Thunderbird 147, fixed in Firefox 148 and Thunderbird 148. It rates the impact high. The advisories are MFSA 2026-13 and MFSA 2026-16.
This CVE is a roll-up. Mozilla lists five Bugzilla bug numbers behind it in the NVD references: 1756056, 1999402, 2004872, 2006037 and 2012855. Mozilla did not publish per-bug detail in the advisory text, so there is no way to say which products or platforms each one touches beyond the shared fix version.
Mozilla's Thunderbird advisory adds a useful note: in general these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potential risks in browser or browser-like contexts. Update anyway, since the fix ships in the same release.
How to check if you're exposed
Check the version number first.
- Firefox: open the menu, choose Help, then About Firefox. On Linux you can also run the command below.
- Thunderbird: open the menu, choose Help, then About Thunderbird.
firefox --version
Anything below 148 is in scope. If a package manager or an enterprise policy controls updates on your machines, check the installed package version there as well, because a browser that has not restarted since an update can still be running old code.
Because the advisory names version 147 specifically, a machine on 147 is the case Mozilla describes directly. Older versions should simply be updated as well.
What to do now
- Update Firefox to 148 or later.
- Update Thunderbird to 148 or later.
- Restart both applications.
- Check that automatic updates are on, or that your deployment tooling picks up new Firefox releases within days, not weeks.
- Rebuild images and appliances that bundle either product.
Why it matters
Mozilla's standard wording for these roll-ups is careful: some bugs showed evidence of memory corruption, and the team presumes that with enough effort some could be exploited. That is a statement about the bug class, not a report of attacks. The weakness attached in NVD is CWE-787 (Out-of-bounds Write), which means a write past the end of a buffer.
Memory safety bugs are the reason browsers ship on a short release cycle. Each release collects fixes found by internal fuzzing and external reporters. Waiting on a single release means carrying every bug in that batch.
The record does not report exploitation and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. Apply the update promptly, which for a browser is usually a restart away.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is one CVE covering several bugs?
Mozilla groups memory safety fixes from a release into one entry. The NVD references list five Bugzilla bugs behind it.
Is arbitrary code execution confirmed?
No. Mozilla says it presumes some of the bugs could be exploited with enough effort. That is a precaution, not a report of exploitation.
Sources
- Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
- Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)
- Red Hat CVE page for CVE-2026-2807
Last reviewed: 19 October 2026.
