Mozilla Firefox up to 147 GC race condition

Summaryinfo

A vulnerability labeled as problematic has been found in Mozilla Firefox up to 147. Affected is an unknown function of the component GC. Such manipulation leads to race condition. This vulnerability is listed as CVE-2026-2802. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Mozilla Firefox up to 147. It has been rated as problematic. Affected by this issue is an unknown part of the component GC. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. The impact remains unknown. CVE summarizes:

Race condition in the JavaScript: GC component. This vulnerability affects Firefox < 148.

The advisory is shared for download at bugzilla.mozilla.org. This vulnerability is handled as CVE-2026-2802 since 02/19/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/04/2026).

The vulnerability scanner Nessus provides a plugin with the ID 300165 (Linux Distros Unpatched Vulnerability : CVE-2026-2802), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 148 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (300165), EUVD (EUVD-2026-8454) and CERT Bund (WID-SEC-2026-0497). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• IGEL OS
• SUSE openSUSE
• RESF Rocky Linux
• Mozilla Firefox
• Mozilla Firefox ESR
• Mozilla Thunderbird

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 147

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion