Security readout for executives and security teams
Plain-English summary
CVE-2026-2799 is a high-severity Mozilla memory safety flaw in DOM Core and HTML handling. A user may need to interact with malicious web or email content for exploitation. Mozilla states it was fixed in Firefox 148 and Thunderbird 148, so unpatched browser and mail-client deployments are the priority concern.
Executive priority
Treat this as a near-term endpoint patching priority. The flaw can affect confidentiality, integrity, and availability, but current supplied evidence does not show confirmed active exploitation. Focus on rapid Mozilla application updates and visibility into remaining unpatched systems.
Technical view
The issue is a CWE-416 use-after-free in Mozilla's DOM Core and HTML component. The CVSS 3.1 score is 8.8 with network attack vector, low complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on endpoints running Mozilla Firefox or Thunderbird that have not received the Firefox 148 or Thunderbird 148 fix, including vendor-packaged builds awaiting equivalent updates. The bundle does not identify other affected products or exact vulnerable version ranges.
Exploitation context
The CVE is not listed as CISA KEV in the source bundle, and no cited source here confirms active exploitation. The CVSS vector suggests a remote attacker would need user interaction, such as opening crafted content in a vulnerable Mozilla application.
Researcher notes
Public details in the bundle are limited to component, weakness class, CVSS, fixed Mozilla releases, and advisory references. Avoid assuming exploit availability or broader product impact. Bugzilla and vendor advisories should be used to confirm technical scope and any downstream packaging decisions.
Mitigation direction
- Update Firefox to version 148 or a vendor build containing the fix.
- Update Thunderbird to version 148 or a vendor build containing the fix.
- Check Mozilla and Red Hat advisories for distribution-specific package status.
- Prioritize endpoints used for web browsing or email handling.
- Use temporary browser and email-content restrictions where patching is delayed.
Validation and detection
- Inventory deployed Firefox and Thunderbird versions across managed endpoints.
- Confirm installed builds include the Firefox 148 or Thunderbird 148 fix.
- Review Red Hat CVE and CSAF/VEX data for package applicability.
- Verify patch deployment through endpoint management or package inventory.
- Track exceptions for systems that cannot be updated immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-2799 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9CISA-ADPCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-02-24T14:03:13.307Z: Reported to Red Hat.
- 2026-02-24T13:33:28.665Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=2014551CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-13/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-16/CVE reference, mozilla
- https://access.redhat.com/security/cve/CVE-2026-2799CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2442303CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2799.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.