Description
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Published: 2026-02-24
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A miscompilation in Firefox and Thunderbird’s JavaScript engine JIT component creates a use‑after‑free condition (CWE‑416). When an attacker can cause the miscompiled code to run, the freed memory can be accessed or overwritten, allowing arbitrary machine instructions to be executed inside the affected process. This can lead to full takeover of the browser or mail client, leaking or tampering with data and potentially disrupting system availability.

Affected Systems

Mozilla Firefox versions prior to 148, Firefox ESR 115.33 and 140.8, and Mozilla Thunderbird versions prior to 148 and 140.8 are affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating high severity. The EPSS score is below 1 %, suggesting a low current probability of exploitation, but the potential impact remains serious. It has not been listed in CISA’s KEV catalog. Exploitation would most likely occur through malicious JavaScript executed in a web page or other scriptable context, providing remote attackers with a path to memory corruption and code execution if the conditions for the miscompilation are met.

Generated by OpenCVE AI on April 15, 2026 at 16:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all affected installations to Firefox 148 or newer, Firefox ESR 115.33 or 140.8, and Thunderbird 148 or 140.8.
  • If patching cannot be performed immediately, set the preference javascript.options.baselinejit to false to disable the JIT compiler for JavaScript, reducing the chance of exploitation.
  • Implement an organization‑wide automatic update policy for Firefox and Thunderbird and restrict JavaScript execution from untrusted origins until the patch is available.

Generated by OpenCVE AI on April 15, 2026 at 16:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4495-1 thunderbird security update
Debian DLA Debian DLA DLA-4496-1 firefox-esr security update
Debian DSA Debian DSA DSA-6148-1 firefox-esr security update
Debian DSA Debian DSA DSA-6152-1 thunderbird security update
History

Mon, 13 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Description JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Sat, 28 Feb 2026 03:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 25 Feb 2026 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 25 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird

Wed, 25 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 24 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Description JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8. JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
References

Tue, 24 Feb 2026 14:00:00 +0000

Type Values Removed Values Added
Description JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.
Title JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
References

Subscriptions

Mozilla Firefox Firefox Esr Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-16T14:27:18.103Z

Reserved: 2026-02-19T15:05:32.669Z

Link: CVE-2026-2764

cve-icon Vulnrichment

Updated: 2026-02-28T02:28:20.262Z

cve-icon NVD

Status : Modified

Published: 2026-02-24T14:16:24.737

Modified: 2026-04-13T15:17:21.690

Link: CVE-2026-2764

cve-icon Redhat

Severity : Important

Publid Date: 2026-02-24T13:33:03Z

Links: CVE-2026-2764 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T17:15:10Z

Weaknesses