Description
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

JIT miscompilation in the JavaScript Engine’s JIT component allows code that has been compiled for execution to behave incorrectly, which can lead to arbitrary code execution and compromise of confidentiality, integrity, or availability. The weakness is identified as CWE‑843, incorrect type handling.

Affected Systems

Mozilla Firefox versions prior to 153 and Mozilla Thunderbird versions prior to 153 are vulnerable. The issue affects all platforms where these browsers are installed.

Risk and Exploitability

The CVSS score of 9.8 marks this as high severity. Though the EPSS score is under 1 % and it is not listed in CISA KEV, the vulnerability remains exploitable through malicious JavaScript that triggers the miscompilation. Attackers can potentially deliver payloads via web content or local scripts that are JIT‑compiled.

Generated by OpenCVE AI on August 3, 2026 at 00:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Mozilla Firefox 153 or later, and Mozilla Thunderbird 153 or later.
  • Enable automatic updates to receive future security fixes promptly.
  • Monitor browser activity for suspicious JavaScript execution and apply content filtering where possible.

Generated by OpenCVE AI on August 3, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1037
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153. JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
References

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-843
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153.
Title JIT miscompilation in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-22T19:19:16.700Z

Reserved: 2026-07-20T21:57:51.809Z

Link: CVE-2026-16410

cve-icon Vulnrichment

Updated: 2026-07-22T18:04:34.422Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T13:17:16.433

Modified: 2026-07-24T16:46:15.703

Link: CVE-2026-16410

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-21T12:38:21Z

Links: CVE-2026-16410 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T00:45:03Z

Weaknesses
  • CWE-1037

    Processor Optimization Removal or Modification of Security-critical Code

  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')