PT-2026-21729 · Mozilla · Thunderbird+1

Gary Kwong · Published 2026-02-24 · Updated 2026-04-09 · CVE-2026-2796

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Thunderbird versions prior to 148

Description The issue is a JIT miscompilation in the JavaScript: WebAssembly component. An LLM, specifically Anthropic’s Claude Opus 4.6, discovered and exploited this issue, demonstrating the potential of AI in vulnerability research. The exploit chain involves a use-after-free, type confusion, memory leak, arbitrary read/write, and ultimately code execution. The vulnerability was identified through a process where the AI explores the codebase, identifies potential bugs, and verifies exploitability through iteration.

Recommendations Firefox versions prior to 148 should be updated to version 148. Thunderbird versions prior to 148 should be updated to version 148.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2026-2796

OPENSUSE-SU-2026:10257-1

Affected Products

Firefox

Thunderbird

References · 73

• https://osv.dev/vulnerability/openSUSE-SU-2026:10257-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2796 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2796 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2796 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-16 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2026-13/#CVE-2026-2796 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-13 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2796 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2796 · Security Note
• https://twitter.com/QCL15/status/2030462023545573712 · Twitter Post
• https://suse.com/security/cve/CVE-2026-2806 · Note
• https://suse.com/security/cve/CVE-2026-2794 · Note
• https://suse.com/security/cve/CVE-2026-2789 · Note
• https://suse.com/security/cve/CVE-2026-2790 · Note
• https://twitter.com/ksg93rd/status/2031374093052731642 · Twitter Post