{"uuid": "79ce37fa-9370-4a3f-ac6a-345c66d8da20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2763", "type": "seen", "source": "https://gist.github.com/alon710/3acd0d8a46cc6e62f0e5fb066cee0b00", "content": "# CVE-2026-2763: CVE-2026-2763: Use-After-Free in SpiderMonkey Generator for-in Loops\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-02-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-2763\n\n## Summary\nA critical use-after-free vulnerability exists in the SpiderMonkey JavaScript engine of Mozilla Firefox and Thunderbird. The flaw occurs when a generator object containing an active for-in loop is garbage-collected before the loop's iterator scope is finalized. This leaves a dangling pointer in the compartment's active enumerators list, allowing attackers to corrupt memory and execute arbitrary code.\n\n## TL;DR\nA use-after-free in Mozilla's SpiderMonkey engine allows unauthenticated attackers to perform a 1-bit memory corruption, altering bytecode to achieve an out-of-bounds read/write primitive.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 9.8\n- **EPSS Score**: 0.00469\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mozilla Firefox\n- Mozilla Firefox ESR\n- Mozilla Thunderbird\n- Mozilla Thunderbird ESR\n- **Firefox**: < 148 (Fixed in: `148`)\n- **Firefox ESR**: < 115.33 (Fixed in: `115.33`)\n- **Firefox ESR**: < 140.8 (Fixed in: `140.8`)\n- **Thunderbird**: < 148 (Fixed in: `148`)\n- **Thunderbird ESR**: < 140.8 (Fixed in: `140.8`)\n\n## Mitigation\n\n- Upgrade to Firefox 148, ESR 115.33, ESR 140.8, or Thunderbird equivalents.\n- Apply sandboxing to isolate browser processes.\n- Disable or restrict JIT optimization in high-risk environments.\n\n**Remediation Steps:**\n1. Identify all systems running vulnerable Firefox or Thunderbird versions.\n2. Deploy the latest vendor patches (v148 or respective ESR updates).\n3. Verify that the installed application binaries match the patched versions.\n\n## References\n\n- [Mozilla Foundation Security Advisory (Firefox ESR 115.33)](https://www.mozilla.org/security/advisories/mfsa2026-13/)\n- [Mozilla Foundation Security Advisory (Firefox 148)](https://www.mozilla.org/security/advisories/mfsa2026-15/)\n- [Mozilla Bugzilla Bug 2012018](https://bugzilla.mozilla.org/show_bug.cgi?id=2012018)\n- [Public Proof of Concept Repository](https://github.com/ppwwiinn/CVE-2026-2763-POC)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-2763) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T10:32:33.757477Z"}