Firefox and Thunderbird: JIT miscompilation in JavaScript engine
Summary
Mozilla Firefox, Firefox ESR and Thunderbird contain a JIT miscompilation flaw in the JavaScript engine's just-in-time compiler. A remote attacker can lure a user to a malicious web page or crafted content, which can lead to high impact on confidentiality and integrity. No availability impact is rated, and user interaction is required.
Affected
- Firefox versions before 158
- Firefox ESR 115 before 115.43
- Firefox ESR 153 before 153.5
- Thunderbird versions before 158
- Thunderbird 153 before 153.5
- Ubuntu marks Thunderbird on 22.04 LTS (jammy) as vulnerable; check your distribution's tracker
Fixed in
- Firefox 158
- Firefox ESR 115.43
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
- Later releases were reported to be covered, but this was not confirmed; use the latest stable build
Workaround
No vendor workaround known. Updating is the required action.
Exploitation
- No evidence of in-the-wild exploitation or public proof of concept found.
- Not checked directly in the CISA KEV catalogue; verify there.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the latest stable build on all endpoints.
- Check Thunderbird on Ubuntu 22.04 and follow your Linux distribution's packages.
- Confirm the installed version on each endpoint and check for ESR 115 installations.
- Prioritise browser fleets with disabled auto-updates.
- Monitor the Mozilla advisories and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-107 (Firefox ESR 115.43) www.mozilla.org
- Mozilla security advisories index www.mozilla.org
- Mozilla known vulnerabilities (Firefox) www.mozilla.org
- Ubuntu CVE page ubuntu.com
- OSV entry (Ubuntu) osv.dev
- Red Hat RHSA-2026:89757 via Vulners vulners.com
- SUSE CVE entry via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:51.
Original description (NVD)
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2076269
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.