Loading vulnerability…
CVE-2026-2764 is a memory-safety vulnerability in the Mozilla JavaScript Engine JIT component affecting Firefox and Thunderbird. The issue is described as a JIT miscompilation leading to a use-after-free condition. In practice, incorrect JIT optimization or code generation can leave the engine operating on freed objects or stale references during JavaScript execution, creating a memory corruption condition within the browser or mail client’s script-processing context. Mozilla fixed the vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Small standalone exploit repository containing two JavaScript proof-of-concept files and a README. The repository targets CVE-2026-2764, described as a SpiderMonkey/Firefox JIT miscompilation plus use-after-free issue in constructor spread handling when a Proxy is used as newTarget during `new Ctor(...arr)` or `Reflect.construct`. The core bug condition is that the Proxy `get` trap executes while the engine is between spreading arguments and creating `this`, allowing mutation or freeing of the spread array while stale assumptions remain in the engine. Repository structure: `README.md` documents the vulnerability, expected behavior on vulnerable builds, and a future exploitation plan; `poc-typeconfusion.js` demonstrates a non-crashing type confusion by changing `arr[0]` from integer `1` to string `"oops"` inside a Proxy `get` trap before `Reflect.construct(D, arr, proxyNewTarget)` completes; `poc-uaf.js` demonstrates a use-after-free by shrinking `sharedArr`, nulling `origArr`, and invoking `gc()` inside the Proxy `get` trap before `Reflect.construct(Middle, [], proxyNewTarget)` completes, aiming to free the elements store mid-spread and trigger a crash. Main exploit capabilities present in code: (1) trigger a deterministic type confusion primitive in JIT/spread argument processing, and (2) trigger a use-after-free leading to process instability or segmentation fault. The README explicitly outlines intended next steps—turning the confusion into addrof/fakeobj, then TypedArray length corruption, arbitrary read/write, and finally a WASM JIT shellcode stage—but none of those later stages are implemented here. As provided, this is a validated PoC repository rather than a complete weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.