CVE-2026-16410

Undergoing Analysis Undergoing Analysis - In Progress

JIT Miscompilation in Firefox JavaScript Engine

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Mozilla Corporation

Description

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-10

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16410

EUVD

EUVD-2026-46248

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 153.0 (exc)
mozilla	firefox	to 153.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This is a JIT miscompilation vulnerability in the JavaScript Engine of Firefox. JIT stands for Just-In-Time compilation, which optimizes JavaScript code execution. A miscompilation here could lead to incorrect code generation, potentially causing crashes or unexpected behavior in the browser.

Detection Guidance

This vulnerability is specific to Firefox's JavaScript Engine JIT component and was fixed in Firefox 153. Detection requires checking Firefox version and monitoring for unusual JavaScript execution patterns. Use commands like 'firefox --version' to verify installed version and 'ps aux | grep firefox' to check running processes.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on your system by tricking you into visiting a malicious website. It may also cause Firefox to crash or behave unpredictably, leading to potential data loss or system instability.

Compliance Impact

This vulnerability does not provide specific details about compliance impacts on standards like GDPR or HIPAA. The high-severity CVSS score (9.8) suggests significant potential for unauthorized data access or system compromise, which could indirectly affect compliance by increasing risks of data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update Firefox to version 153 or later to address the JIT miscompilation vulnerability in the JavaScript Engine.

Hi! I’m here to help you understand CVE-2026-16410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70