CVE-2026-2804 - Use-after-free in the JavaScript: WebAssembly component

MEDIUM

Use-after-free in the JavaScript: WebAssembly component

Published Feb 24, 2026

6.1

MEDIUM

CVSS 3.1

EPSS 0.29%

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/firefox-flatpak	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/thunderbird-flatpak	Not affected	n/a
Red Hat Enterprise Linux 10	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 6	firefox	Not affected	n/a
Red Hat Enterprise Linux 6	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 7	firefox	Not affected	n/a
Red Hat Enterprise Linux 7	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 8	firefox	Not affected	n/a
Red Hat Enterprise Linux 8	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 9	firefox	Not affected	n/a
Red Hat Enterprise Linux 9	thunderbird	Not affected	n/a

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (1)

CWE-416

Use After Free

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-2804		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=2013584		Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2442332		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-2804
https://www.cve.org/CVERecord?id=CVE-2026-2804
https://www.mozilla.org/security/advisories/mfsa2026-13/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-13/#CVE-2026-2804
https://www.mozilla.org/security/advisories/mfsa2026-16/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-16/#CVE-2026-2804