Executive brief
A vulnerability exists in the Firefox web browser's JavaScript engine. This component is responsible for executing code on websites to provide interactive features. An exploit could allow a malicious website to execute unauthorized code or crash the browser, potentially compromising user data or system stability. Users should update to Firefox 153 or later to resolve this issue.
Technical details
A JIT (Just-In-Time) miscompilation vulnerability exists in the Mozilla Firefox JavaScript Engine's JIT component. The flaw occurs when the engine incorrectly optimizes JavaScript code, leading to memory safety violations or incorrect execution logic. An attacker could exploit this by enticing a user to visit a specially crafted website, potentially achieving remote code execution (RCE) within the context of the browser process. The vulnerability is tracked as CVE-2026-16410 and was fixed in Firefox version 153. While the specific bug report (Bug 2053680) is restricted, similar JIT miscompilations typically involve type confusion or bounds check elimination errors.
Affected products
- Mozilla Firefox < 153
Timeline
- 2026-07-21: advisory: Mozilla Foundation Security Advisory 2026-68 published
- 2026-07-21: patched: Fixed in Firefox 153