External risk intelligence

Firefox and Thunderbird Use-After-Free Vulnerability in Audio Video Playback Component

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-2772

This vulnerability affects web browsers and email clients (Firefox and Thunderbird). These applications are client-side software used on end-user devices, not public-facing servers, gateways, or internet-accessible services. While they interact with the internet to fetch content, they are not deployed as reachable network services.

Use After Free

Mozilla Firefox

before 115.33.0before 148.0128.0 to before 140.8.0before 140.8.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability has been identified in the Audio/Video playback component of Mozilla Firefox and Thunderbird. This critical issue could potentially allow for significant compromise of affected systems.

Audio/video playback flaw in Firefox and Thunderbird.
Critical flaw could allow significant system compromise.
Confirm relevance and ensure software is up-to-date.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted audio or video file over the internet. When a user interacts with this file through a vulnerable application, the bug in the playback component could be triggered. This could allow an attacker to execute arbitrary code on the user's system.

No special access required.
Malicious audio/video file playback.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Audio/Video: Playback component could allow an attacker to execute arbitrary code. This may occur when processing media content, potentially impacting the integrity and availability of the affected application.

Application data and system integrity at risk.
Malicious media content could trigger exposure.
Arbitrary code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability resides within the Audio/Video playback component of Firefox and Thunderbird. Owners of these applications, likely desktop or endpoint management teams, should prioritize identifying all instances of affected software. The first practical step involves confirming reachability and business criticality, then assigning an accountable owner for remediation planning based on the assessed risk.

Application owners should address this issue.
Verify all affected software installations.
Plan and schedule remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What software is affected by CVE-2026-2772?

This vulnerability affects the Mozilla Firefox web browser and the Thunderbird email client. These applications are widely used for browsing the web and managing email, and they rely on integrated components to handle and render various media formats, such as audio and video content found on the internet.

What does use-after-free mean in this context?

A use-after-free, classified as CWE-416, is a memory-related weakness. It occurs when an application continues to use a section of computer memory after that memory has been cleared or released. In this specific case, the flaw exists within the Audio/Video playback component, which could allow an attacker to interfere with how the software manages memory, potentially leading to unauthorized control over the system.

How is this vulnerability triggered?

This bug is triggered when a user processes a specially crafted audio or video file through the vulnerable browser or email client. It does not trigger during standard operations that do not involve parsing malicious media content. If the application is not interacting with an attacker-controlled or corrupted media file, the specific memory error does not occur.

Is my machine at risk per Halo Surface Signal?

According to Halo Surface Signal, this risk is classified as very unlikely for infrastructure. Because Firefox and Thunderbird are client-side desktop applications used on end-user devices, they are not typically deployed as internet-facing servers or public services. While the software retrieves internet content, the threat model differs significantly from that of a reachable network gateway or server service.

How should I respond to this vulnerability?

The most effective way to address this is to ensure your applications are updated to the patched versions provided by Mozilla. Specifically, verify that your Firefox or Thunderbird installation is updated to version 148, or the relevant ESR release (115.33 or 140.8). If you manage these applications in an enterprise environment, confirm that your standard patch management cycles are applied to all user workstations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.