Description
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from a miscompilation in the JavaScript Engine’s JIT component, which allows an attacker to cause the engine to execute incorrectly compiled code. This defect can lead to arbitrary code execution when a user visits a malicious web page or runs untrusted JavaScript, potentially compromising the client system’s confidentiality, integrity, and availability. The issue is classified as CWE‑843 (Type Confusion).

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. The flaw was fixed in Firefox version 153, Firefox Extended Support Release 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. All versions released before these require remediation.

Risk and Exploitability

The CVSS score of 9.8 and the EPSS score of less than 1% suggests exploitation is unlikely at the moment, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves malicious web content that exploits the JIT engine; attackers would need to entice a user to access a crafted page that triggers the miscompilation. The impact is potentially complete compromise of the affected client machine.

Generated by OpenCVE AI on August 4, 2026 at 05:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Mozilla Firefox and Thunderbird releases (≥ 153 or the specified ESR versions) that contain the JIT miscompilation fix.
  • If you deploy other Mozilla‑based software that embeds the Gecko engine (such as embedded browsers or enterprise applications), update those components to at least the patched versions listed in the advisory.
  • Until an official patch is available for delayed‑update environments, temporarily disable JIT compilation in affected browsers by setting 'javascript.options.baselinejit' to 0 and, if possible, also disabling 'javascript.options.wasm' to reduce risk.

Generated by OpenCVE AI on August 4, 2026 at 05:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4695-1 firefox-esr security update
Debian DLA Debian DLA DLA-4727-1 thunderbird security update
Debian DSA Debian DSA DSA-6394-1 firefox-esr security update
Debian DSA Debian DSA DSA-6418-1 thunderbird security update
History

Fri, 24 Jul 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
References

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-843
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
Title JIT miscompilation in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-22T19:18:29.451Z

Reserved: 2026-07-20T21:55:59.129Z

Link: CVE-2026-16355

cve-icon Vulnrichment

Updated: 2026-07-22T15:38:20.605Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T13:17:04.000

Modified: 2026-07-24T15:27:33.097

Link: CVE-2026-16355

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-21T12:37:43Z

Links: CVE-2026-16355 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T06:00:05Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')