Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Mozilla
  • Firefox
  • Thunderbird

Configuration 1 [-]

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*

No data.

References
Link Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2013561 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-2797 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-2797 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-13/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-13/#CVE-2026-2797 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-16/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-16/#CVE-2026-2797 cve-icon
History

Sat, 28 Feb 2026 04:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Sat, 28 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 25 Feb 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 25 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird

Tue, 24 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148. Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
References

Tue, 24 Feb 2026 14:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148.
Title Use-after-free in the JavaScript: GC component
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-02-24T13:33:27.406Z

Updated: 2026-02-26T20:52:49.775Z

Reserved: 2026-02-19T15:06:45.386Z

Link: CVE-2026-2797

cve-icon Vulnrichment

Updated: 2026-02-26T20:15:50.844Z

cve-icon NVD

Status : Modified

Published: 2026-02-24T14:16:28.200

Modified: 2026-02-26T22:20:51.097

Link: CVE-2026-2797

cve-icon Redhat

Severity : Important

Publid Date: 2026-02-24T13:33:27Z

Links: CVE-2026-2797 - Bugzilla