DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-2763: CVE-2026-2763: Use-After-Free in SpiderMonkey Generator for-in Loops

#security #cve #cybersecurity

CVE-2026-2763: Use-After-Free in SpiderMonkey Generator for-in Loops

Vulnerability ID: CVE-2026-2763
CVSS Score: 9.8
Published: 2026-02-24

A critical use-after-free vulnerability exists in the SpiderMonkey JavaScript engine of Mozilla Firefox and Thunderbird. The flaw occurs when a generator object containing an active for-in loop is garbage-collected before the loop's iterator scope is finalized. This leaves a dangling pointer in the compartment's active enumerators list, allowing attackers to corrupt memory and execute arbitrary code.

TL;DR

A use-after-free in Mozilla's SpiderMonkey engine allows unauthenticated attackers to perform a 1-bit memory corruption, altering bytecode to achieve an out-of-bounds read/write primitive.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-416
  • Attack Vector: Network (Unauthenticated)
  • CVSS v3.1 Score: 9.8
  • EPSS Score: 0.00469
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • Mozilla Firefox
  • Mozilla Firefox ESR
  • Mozilla Thunderbird
  • Mozilla Thunderbird ESR
  • Firefox: < 148 (Fixed in: 148)
  • Firefox ESR: < 115.33 (Fixed in: 115.33)
  • Firefox ESR: < 140.8 (Fixed in: 140.8)
  • Thunderbird: < 148 (Fixed in: 148)
  • Thunderbird ESR: < 140.8 (Fixed in: 140.8)

Exploit Details

  • GitHub: Proof-of-Concept demonstrating use-after-free and array capacity corruption via generator scope collection

Mitigation Strategies

  • Upgrade to Firefox 148, ESR 115.33, ESR 140.8, or Thunderbird equivalents.
  • Apply sandboxing to isolate browser processes.
  • Disable or restrict JIT optimization in high-risk environments.

Remediation Steps:

  1. Identify all systems running vulnerable Firefox or Thunderbird versions.
  2. Deploy the latest vendor patches (v148 or respective ESR updates).
  3. Verify that the installed application binaries match the patched versions.

References

Read the full report for CVE-2026-2763 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)