CVE-2026-109722

Deferred Deferred - Pending Action

JIT Miscompilation in Firefox JavaScript Engine

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Mozilla Corporation

Description

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109722

EUVD

EUVD-2026-98642

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 158 (inc)
mozilla	firefox_esr	to 115.43 (inc)
mozilla	firefox_esr	to 153.5 (inc)
mozilla	firefox	to 115.43 (inc)
mozilla	firefox	to 153.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Attack-Flow Graph

Executive Summary

This vulnerability is a JIT miscompilation issue in the JavaScript Engine. JIT stands for Just-In-Time compilation, which is used to improve the performance of JavaScript code by compiling it to machine code at runtime. A miscompilation here means the engine incorrectly translates JavaScript code into machine code, potentially leading to unexpected behavior or security flaws.

Detection Guidance

Detection requires checking Firefox version. Run 'firefox --version' or check 'about:support' in Firefox. Versions below 158 or ESR 115.43/153.5 are vulnerable.

Impact Analysis

The impact could include arbitrary code execution, crashes, or unexpected behavior in applications using the affected Firefox versions. Attackers might exploit this to run malicious code on your system, steal data, or disrupt services. Users of Firefox versions before 158, Firefox ESR 115.43, or Firefox ESR 153.5 are at risk.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. Without additional context on data exposure or processing implications, its effect on compliance cannot be determined.

Mitigation Strategies

Update Firefox to version 158 or Firefox ESR to 115.43 or 153.5 immediately. Disable JavaScript if updates are not possible, but this may break functionality.

Hi! I’m here to help you understand CVE-2026-109722. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70