PT-2026-21729

CVE-2026-2796

Published

2026-02-24

Updated

2026-08-25

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Thunderbird versions prior to 148

Description A JIT miscompilation issue exists in the JavaScript: WebAssembly component. JIT (Just-In-Time) compilation is a method used by browsers to improve execution speed by compiling code during runtime. This flaw can lead to a sequence of failures including use-after-free, type confusion, memory leak, and arbitrary read/write, potentially resulting in remote code execution.

Recommendations Update Firefox to version 148 or later. Update Thunderbird to version 148 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Gary Kwong

Vendors

Affected products

Weakness enumeration

CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')

Related identifiers