Description
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Published: 2026-02-24
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential memory corruption that may allow code execution
Action: Apply patch
AI Analysis

Impact

Incorrect boundary conditions were found in the JavaScript: WebAssembly component. The flaw causes the component to miscalculate array lengths or memory limits, which could corrupt memory. This corruption can in theory lead to arbitrary code execution, denial of service, or instability within the affected process. The description does not detail the full range of consequences, so the impact is limited to what is known about such boundary errors.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. Versions before 148 of each browser contain the vulnerability; any installation of these products on Windows, macOS, Linux, or mobile platforms that predates the fix is vulnerable.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high severity condition. The EPSS score is reported as less than 1 %, suggesting that real‑world exploitation is unlikely at the moment. The vulnerability is not listed in the CISA KEV catalog. The description does not specify a precise attack vector; it is inferred that triggering the flaw would require a malicious WebAssembly module, but this inference is not confirmed by the official data.

Generated by OpenCVE AI on April 15, 2026 at 16:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox and Thunderbird to version 148 or later to receive the fix.
  • Until the upgrade can be applied, disable WebAssembly in the affected browsers; for Firefox set the about:config preference \"javascript.options.wasm\" to false, and use enterprise policy to disable the feature.
  • Monitor browser activity for unexpected WebAssembly module loading and keep browsers up to date with the latest security patches from Mozilla.

Generated by OpenCVE AI on April 15, 2026 at 16:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148. Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Sat, 28 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 25 Feb 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-754
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Wed, 25 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird

Tue, 24 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148. Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
References

Tue, 24 Feb 2026 14:00:00 +0000

Type Values Removed Values Added
Description Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148.
Title Incorrect boundary conditions in the JavaScript: WebAssembly component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T13:54:26.297Z

Reserved: 2026-02-19T15:06:54.497Z

Link: CVE-2026-2801

cve-icon Vulnrichment

Updated: 2026-02-26T20:03:39.233Z

cve-icon NVD

Status : Modified

Published: 2026-02-24T14:16:28.610

Modified: 2026-04-13T15:17:31.090

Link: CVE-2026-2801

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-02-24T13:33:29Z

Links: CVE-2026-2801 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T17:00:07Z

Weaknesses