CVE-2026-2783: mozilla firefox Type Confusion
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2026-2783DEBIAN-CVE-2026-2783CGA-3jrx-633x-qhg9CGA-7hg8-jj86-8wrxCGA-g23v-pxcj-r938CGA-r6gc-4rrg-q88r
Published 24-02-2026Last modified 13-04-2026
Vulnerability summary
CVE-2026-2783 is a high (CVSS 7.5) Type Confusion vulnerability in mozilla firefox. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.42%
0%100%
Low · +0.13 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 39 · Related 9DLA-4495-1DLA-4496-1DSA-6148-1DSA-6152-1MGASA-2026-0052MGASA-2026-0053OPENSUSE-SU-2026:10242-1OPENSUSE-SU-2026:10248-1OPENSUSE-SU-2026:10257-1OPENSUSE-SU-2026:20365-1OPENSUSE-SU-2026:20391-1RHSA-2026:3338RHSA-2026:3339RHSA-2026:3361RHSA-2026:3491RHSA-2026:3492RHSA-2026:3493RHSA-2026:3494RHSA-2026:3495RHSA-2026:3496RHSA-2026:3497RHSA-2026:3515RHSA-2026:3516RHSA-2026:3517RHSA-2026:3976RHSA-2026:3978RHSA-2026:3979RHSA-2026:3980RHSA-2026:3981RHSA-2026:3982RHSA-2026:3983RHSA-2026:3984RHSA-2026:4022RHSA-2026:4152RHSA-2026:4260RHSA-2026:4432SUSE-SU-2026:0812-1SUSE-SU-2026:0871-1SUSE-SU-2026:0880-1CGA-XQ5X-RMX6-MGFG
Timeline
- 24-02-2026PublishedVulnerability first disclosed.
- 13-04-2026Last modifiedVulnerability information updated.
Description
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources6 sources · 6.5–7.5
- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.13 pp
From 0.29% on 20-09-2026
20-09-202620-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Ubuntu8 products
- mozjs102All versions (No fix recorded)
- mozjs115All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Chainguard2 products
- firefox< 140.8.0-r0
- firefox-esr< 140.8.0-r0
Debian2 products
- firefox-esr< 140.8.0esr-1~deb12u1 | < 140.8.0esr-1~deb13u1 | < 140.8.0esr-1
- thunderbird< 1:140.8.0esr-1~deb12u1 | < 1:140.8.0esr-1~deb13u1 | < 1:140.8.0esr-1
Mozilla2 products
- firefox< 140.8.0 | < 148.0
- thunderbird< 140.8.0 | < 148.0
Wolfi1 product
- firefox< 140.8.0-r0
5 vendors · 15 products
