CVE-2026-2796

JIT miscompilation in the JavaScript: WebAssembly component

Published Feb 24, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Analysis

Technical impact

This vulnerability is a miscompilation in the Just‑In‑Time compiler for the WebAssembly component of Mozilla products. The flaw is classified as CWE‑843, indicating a type confusion that can lead to unintended type handling, memory corruption, and ultimately arbitrary code execution. An attacker who can deliver malicious WebAssembly code to a vulnerable installation could gain full control over the affected process, compromising confidentiality, integrity and availability of the system.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. Specified affected versions are any releases prior to Firefox 148 and Thunderbird 148. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 9.8 signals very high severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the lack of publicly disclosed exploits does not reduce the risk inherent in a high‑severity JIT fault. The likely attack vector is a malicious webpage or email message that exploits WebAssembly execution in a victim’s browser or email client.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`148`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`148`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[0,148)`	affected	generic	—

Mozilla

Thunderbird

Version	Status	Scheme	Platform
`[0,148)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox to version 148 or later and upgrade Thunderbird to version 148 or later.
If an immediate upgrade is not feasible, block or disable WebAssembly execution (for example, by turning off the "javascript.options.wasm" preference or using group policy to disable WebAssembly).
Maintain updated antivirus, intrusion detection and application whitelisting controls to detect any anomalous activity that could indicate exploitation of this flaw.

Generated by OpenCVE AI on April 15, 2026 at 15:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.948% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-2796
https://bugzilla.mozilla.org/show_bug.cgi?id=2013165
https://bugzilla.redhat.com/show_bug.cgi?id=2442301
https://nvd.nist.gov/vuln/detail/CVE-2026-2796
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2796.json
https://www.cve.org/CVERecord?id=CVE-2026-2796
https://www.mozilla.org/security/advisories/mfsa2026-13/
https://www.mozilla.org/security/advisories/mfsa2026-13/#CVE-2026-2796
https://www.mozilla.org/security/advisories/mfsa2026-16/
https://www.mozilla.org/security/advisories/mfsa2026-16/#CVE-2026-2796

History

Apr 13, 2026 2:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148.	JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Feb 28, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-2796 https://www.cve.org/CVERecord?id=CVE-2026-2796 https://www.mozilla.org/security/advisories/mfsa2026-13/#CVE-2026-2796 https://www.mozilla.org/security/advisories/mfsa2026-16/#CVE-2026-2796
Metrics	threat_severity `None`	threat_severity `Important`

Feb 27, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 25, 2026 6:45 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-843
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:thunderbird:::::-:::*
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Feb 25, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox Mozilla thunderbird
Vendors & Products		Mozilla Mozilla firefox Mozilla thunderbird

Feb 24, 2026 6:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148.	JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
References		https://www.mozilla.org/security/advisories/mfsa2026-16/

Feb 24, 2026 2:00 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148.
Title		JIT miscompilation in the JavaScript: WebAssembly component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2013165 https://www.mozilla.org/security/advisories/mfsa2026-13/