CVE-2026-4702

JIT miscompilation in the JavaScript Engine component

Published Mar 24, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Analysis

Technical impact

The vulnerability arises from a Just‑In‑Time (JIT) compiler miscompilation in the JavaScript engine. This defect can allow an attacker to execute arbitrary code within the context of a vulnerable application. The weakness is classified as an improper use of a data type, as reflected by the CWE identifiers, and has the potential to compromise confidentiality, integrity, and availability.

Affected Systems

Affected products are Mozilla Firefox and Mozilla Thunderbird, including the standard releases and ESR tracks. Versions before Firefox 149 and ESR 140.9, and before Thunderbird 149 and ESR 140.9, contain the unpatched JIT miscompilation. All other newer releases include the fix.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of JIT miscompilation, the likely attack vector is remote via malicious JavaScript executed in a browser context, although explicit exploit details are not provided in the dataset.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.9`	unaffected	≤ 140.*
`149`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.9`	unaffected	≤ 140.*
`149`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[0,149)`	affected	generic	—

Mozilla

Firefox Esr

Version	Status	Scheme	Platform
`[0,140.9)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Firefox to version 149 or later, or ESR 140.9 or later, and update Thunderbird to version 149 or later, or ESR 140.9 or later.
If an upgrade is not possible, restrict JavaScript execution through the browser security settings or use a sandboxed browsing environment.
Monitor Mozilla’s security advisories for any additional patches or workarounds.

Generated by OpenCVE AI on April 13, 2026 at 15:47 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4510-1	firefox-esr security update
Debian DLA	DLA-4511-1	thunderbird security update
Debian DSA	DSA-6178-1	firefox-esr security update
Debian DSA	DSA-6179-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.716% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2013560
https://nvd.nist.gov/vuln/detail/CVE-2026-4702
https://www.cve.org/CVERecord?id=CVE-2026-4702
https://www.mozilla.org/security/advisories/mfsa2026-20/
https://www.mozilla.org/security/advisories/mfsa2026-22/
https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2026-4702
https://www.mozilla.org/security/advisories/mfsa2026-23/
https://www.mozilla.org/security/advisories/mfsa2026-24/
https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2026-4702

History

Apr 13, 2026 2:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.	JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mar 26, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-733
References		https://nvd.nist.gov/vuln/detail/CVE-2026-4702 https://www.cve.org/CVERecord?id=CVE-2026-4702 https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2026-4702 https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2026-4702
Metrics	threat_severity `None`	threat_severity `Moderate`

Mar 25, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mar 25, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla firefox Esr
Vendors & Products		Mozilla firefox Esr

Mar 24, 2026 8:45 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Weaknesses		CWE-843
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:firefox:::::esr:::*
Vendors & Products		Mozilla Mozilla firefox
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Mar 24, 2026 8:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.	JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
References		https://www.mozilla.org/security/advisories/mfsa2026-23/ https://www.mozilla.org/security/advisories/mfsa2026-24/

Mar 24, 2026 12:45 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.
Title		JIT miscompilation in the JavaScript Engine component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2013560 https://www.mozilla.org/security/advisories/mfsa2026-20/ https://www.mozilla.org/security/advisories/mfsa2026-22/