CVE-2026-2758
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Analysis
Use-after-free in Firefox JavaScript garbage collector before 148 allows remote code execution through crafted JavaScript.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify and inventory all affected Firefox and Thunderbird versions across the organization; disable JavaScript execution in browser security settings where feasible for non-critical users. Within 7 days: Deploy network-level filtering to block known malicious domains; implement endpoint detection and response (EDR) tuning for suspicious JavaScript GC component behavior; communicate risks to end-users and restrict high-risk web browsing. …
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today