Executive brief
A vulnerability exists in the Firefox web browser's JavaScript engine. An attacker could potentially exploit this flaw by tricking a user into visiting a malicious website, leading to unpredictable program behavior or security bypasses. This issue has been resolved in Firefox version 153.
Technical details
A JIT (Just-In-Time) miscompilation vulnerability was identified in the JIT component of the Mozilla Firefox JavaScript Engine. The flaw occurs when the engine incorrectly compiles JavaScript code into machine code, potentially leading to type confusion or memory safety violations. An attacker can exploit this by delivering specially crafted JavaScript via a website. Successful exploitation could allow for arbitrary code execution or a sandbox escape, though the specific impact depends on the nature of the miscompilation. The issue is tracked as Bug 2044606 and is fixed in Firefox 153.
Affected products
- Mozilla Firefox < 153
Timeline
- 2026-07-21: advisory: Mozilla Foundation Security Advisory 2026-68 published
- 2026-07-21: patched: Fixed in Firefox 153