Description
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Published: 2026-10-27
Score: n/a
EPSS: n/a
KEV: No
Impact: Use-after‑free leading to potential remote code execution
Action: Apply Patch
AI Analysis

Impact

The bug is a use‑after‑free in Firefox’s JavaScript just‑in‑time compiler. If attacker‑controlled JavaScript runs in the browser, the engine may access memory that has already been freed, allowing the attacker to execute arbitrary code and take control of the process. The fix was released with Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Affected Systems

Mozilla Firefox. Any installation that predates the release of Firefox 159 or the ESR 153.6 update is susceptible. Mozilla Thunderbird. Any installation that predates Thunderbird 159 or the ESR 153.6 update is also at risk.

Risk and Exploitability

Based on the description, the likely attack vector involves delivering malicious script to the browser, though the CVE text does not explicitly specify this. The potential for remote code execution and the lack of mitigation through networking alone make this a high‑risk issue. Exploit probability is not quantified due to missing EPSS data, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog.

Generated by OpenCVE AI on October 27, 2026 at 22:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 159 or later, or apply the ESR 153.6 update if using the extended support channel
  • If an immediate upgrade is impossible, disable the JIT compiler via about:config settings to reduce the attack surface, noting this may degrade performance and is a temporary measure
  • Consider running the browser within a sandboxed or containerized environment to limit the impact of any potential exploitation.

Generated by OpenCVE AI on October 27, 2026 at 22:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 27 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, and Thunderbird 159. Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References

Tue, 27 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, and Thunderbird 159.
References

Tue, 27 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 27 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 27 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Title Use-after-free in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-27T18:28:35.952Z

Reserved: 2026-10-27T14:05:16.307Z

Link: CVE-2026-117898

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-27T14:16:45.240

Modified: 2026-10-27T19:17:15.067

Link: CVE-2026-117898

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T22:45:09Z

Weaknesses

No weakness.