PT-2026-21729 · Mozilla · Firefox+1

Gary Kwong · Published 2026-02-24 · Updated 2026-05-11 · CVE-2026-2796

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Thunderbird versions prior to 148

Description A JIT miscompilation issue exists in the JavaScript: WebAssembly component. JIT (Just-In-Time) compilation is a method used by browsers to improve execution speed by compiling code during runtime. This flaw can lead to a sequence of failures including use-after-free, type confusion, memory leak, and arbitrary read/write, potentially resulting in remote code execution.

Recommendations Update Firefox to version 148 or later. Update Thunderbird to version 148 or later.

Exploit

Fix

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2026-06194

CVE-2026-2796

OPENSUSE-SU-2026:10257-1

Affected Products

Firefox

Thunderbird

References · 85

• 🔥 https://github.com/WostGit/CVE-2026-2796 · Exploit
• https://mozilla.org/security/advisories/mfsa2026-16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-2796 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/729338 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2026-16 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2796 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2026-13/#CVE-2026-2796 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-13 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2796 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2796 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06194 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10257-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0423SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2796 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory