CVE-2026-8388 - Vulnerability Details

- Incorrect boundary conditions in the JavaScript Engine: JIT component

Description

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Published: 2026-05-12

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The issue is incorrect boundary conditions in the JavaScript engine’s just-in-time (JIT) component. The description does not mention the precise impact, yet such a defect, a CWE-119 and CWE-787 vulnerability, could lead to memory corruption or instability.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. Versions of Firefox earlier than 150.0.3, and any Firefox ESR releases before 115.36 or before 140.11, are vulnerable, because the defect was fixed in Firefox 150.0.3, Firefox ESR 115.36, and Firefox ESR 140.11. Thunderbird releases older than 140.11 are also affected, as the fix came in Thunderbird 140.11. No other products or versions are explicitly mentioned.

Risk and Exploitability

The vulnerability is not listed in the CISA KEV catalog and the EPSS score of < 1% indicates a very low probability of exploitation. The CVSS score of 6.5 indicates a moderate severity threat. Potential exploitation would likely occur via malicious web content that triggers the vulnerable path in the JIT compiler. Based on the information, it is inferred that an attacker could induce memory corruption by delivering crafted JavaScript to a vulnerable browser instance.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.36`	unaffected	≤ 115.*
`140.11`	unaffected	≤ 140.*
`150.0.3`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.11`	unaffected	≤ *

Configuration 1 [-]

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[150.0.3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox to version 150.0.3 or later, or to Firefox ESR 115.36 or 140.11.
Upgrade Mozilla Thunderbird to version 140.11 or later.
If an upgrade cannot be performed immediately, consider disabling JavaScript execution globally or enforcing a strict content‑security‑policy that blocks suspicious scripts.
Monitor browser log files and system events for crashes or anomalous memory‑access errors that may indicate an exploit attempt.
Verify that the JIT compiler implements comprehensive bounds checking to guard against out‑of‑bounds writes (CWE‑787).

Generated by OpenCVE AI on May 20, 2026 at 01:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4592-1	firefox-esr security update
Debian DLA	DLA-4594-1	thunderbird security update
Debian DSA	DSA-6283-1	firefox-esr security update
Debian DSA	DSA-6288-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2036978
https://nvd.nist.gov/vuln/detail/CVE-2026-8388
https://www.cve.org/CVERecord?id=CVE-2026-8388
https://www.mozilla.org/security/advisories/mfsa2026-45/
https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8388
https://www.mozilla.org/security/advisories/mfsa2026-47/
https://www.mozilla.org/security/advisories/mfsa2026-48/
https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8388
https://www.mozilla.org/security/advisories/mfsa2026-51/

History

Wed, 20 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-8388 https://www.cve.org/CVERecord?id=CVE-2026-8388 https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8388 https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8388
Metrics	threat_severity `None`	threat_severity `Important`

Tue, 19 May 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description	Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, and Firefox ESR 140.11.	Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
References		https://www.mozilla.org/security/advisories/mfsa2026-51/

Tue, 19 May 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787

Tue, 19 May 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description	Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.	Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, and Firefox ESR 140.11.
References		https://www.mozilla.org/security/advisories/mfsa2026-47/ https://www.mozilla.org/security/advisories/mfsa2026-48/

Tue, 12 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::*

Tue, 12 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 12 May 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-787

Tue, 12 May 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 12 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
Title		Incorrect boundary conditions in the JavaScript Engine: JIT component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2036978 https://www.mozilla.org/security/advisories/mfsa2026-45/

Subscriptions

Mozilla Firefox

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-05-12T12:36:10.633Z

Updated: 2026-05-19T17:10:46.244Z

Reserved: 2026-05-12T12:36:09.855Z

Link: CVE-2026-8388

Vulnrichment

Updated: 2026-05-12T18:28:17.148Z

NVD

Status : Modified

Published: 2026-05-12T14:17:11.813

Modified: 2026-05-19T18:16:31.167

Link: CVE-2026-8388

Redhat

Severity : Important

Publid Date: 2026-05-12T12:36:10Z

Links: CVE-2026-8388 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-20T01:30:06Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object