critical9.8
CVE-2026-2767
Use-after-free in the JavaScript: WebAssembly component.
Impact
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 140.8.0 before 148.0 |
| Mozilla | Thunderbird | before 140.8.0 before 148.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=2013741
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338
- https://access.redhat.com/errata/RHSA-2026:3339
- https://access.redhat.com/errata/RHSA-2026:3361
- https://access.redhat.com/errata/RHSA-2026:3491
- https://access.redhat.com/errata/RHSA-2026:3492
- https://access.redhat.com/errata/RHSA-2026:3493
- https://access.redhat.com/errata/RHSA-2026:3494
- https://access.redhat.com/errata/RHSA-2026:3495
- https://access.redhat.com/errata/RHSA-2026:3496
- https://access.redhat.com/errata/RHSA-2026:3497
- https://access.redhat.com/errata/RHSA-2026:3515
- https://access.redhat.com/errata/RHSA-2026:3516
- https://access.redhat.com/errata/RHSA-2026:3517
- https://access.redhat.com/errata/RHSA-2026:3976
- https://access.redhat.com/errata/RHSA-2026:3978
- https://access.redhat.com/errata/RHSA-2026:3979
- https://access.redhat.com/errata/RHSA-2026:3980
- https://access.redhat.com/errata/RHSA-2026:3981
- https://access.redhat.com/errata/RHSA-2026:3982
- https://access.redhat.com/errata/RHSA-2026:3983