CVE-2026-16363

Analyzed Analyzed - Analysis Complete

JIT Miscompilation in Firefox JavaScript Engine

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Mozilla Corporation

Description

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16363

EUVD

EUVD-2026-46194

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.0.0 (exc)
mozilla	firefox	to 140.13.0 (exc)
mozilla	thunderbird	to 140.13.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-682	The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

Executive Summary

This vulnerability involves a JIT miscompilation issue in the JavaScript: WebAssembly component of Firefox. It was addressed in Firefox version 153 and Firefox ESR version 140.13.

Detection Guidance

This vulnerability is specific to Firefox versions before 153 and Firefox ESR before 140.13. To detect it, check your installed Firefox version with commands like 'firefox --version' or 'apt show firefox' (Linux). If the version is below the fixed release, the system is vulnerable.

Impact Analysis

The miscompilation could lead to unexpected behavior or crashes in affected Firefox versions. It may also allow for potential security bypasses or memory corruption if exploited.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability involves JIT miscompilation in Firefox's JavaScript: WebAssembly component, which could theoretically lead to memory corruption or arbitrary code execution, but no explicit compliance implications are mentioned.

Mitigation Strategies

Update Firefox to version 153 or later and Firefox ESR to version 140.13 or later to address the JIT miscompilation issue in the JavaScript: WebAssembly component.

Hi! I’m here to help you understand CVE-2026-16363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70