home / blog
2026-10-29 · high
CVE-2026-109722: JIT Miscompilation in Firefox and Thunderbird
JIT miscompilation Firefox/Thunderbird (CVSS 8.1). Patches: Firefox 158, ESR 115.43/153.5, Thunderbird 158/153.5.
CVE-2026-109722 is a JIT (Just-In-Time) miscompilation vulnerability in the JavaScript Engine affecting Firefox, Firefox ESR, and Thunderbird. The flaw resides in the JIT component and may allow malicious code execution through unsafe JavaScript processing during JIT compilation.
The vulnerability carries a CVSS score of 8.1 (high severity). Mozilla has confirmed fixes in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5, published alongside the October 13, 2026 CVE disclosure. Public signals on GitHub (October 29, 2026) indicate research community interest, although active exploitation has not been confirmed.
System administrators and IT teams must update Firefox and Thunderbird to the patched versions with high priority. In ESR environments, apply patch 115.43 (for ESR 115 line) or 153.5 (for ESR 153 line). Verify deployment on corporate clients, endpoint systems, and remote access configurations. The severity rating warrants assessment and remediation within 48-72 hours.
At a glance
- What
- JIT miscompilation in the JavaScript Engine. Vulnerability present in Firefox, Firefox ESR (115 and 153 branches) and Thunderbird.
- Severity
- CVSS 8.1 (high). Potential code execution during JavaScript processing and compilation.
- Affected versions
- Firefox < 158; Firefox ESR < 115.43 and < 153.5; Thunderbird < 158 and < 153.5.
- Fix
- Update to Firefox 158, Firefox ESR 115.43 or 153.5, Thunderbird 158 or 153.5.
- Status
- Official patch released by Mozilla. Public signals on GitHub detected October 29, 2026. Active exploitation: not confirmed.
- Action
- Update immediately. Priority: high. Timeline: 48-72 hours. Scope: corporate clients, endpoint systems, remote access infrastructure.
Sources: NVD, CVE-2026-109722