Executive brief
A vulnerability exists in the JavaScript engine used by Firefox and Thunderbird. This engine is responsible for running scripts on websites and within emails. An attacker could exploit this flaw to potentially execute unauthorized code or crash the application, which could lead to the theft of sensitive user data or a complete takeover of the user's browser session.
Technical details
A use-after-free vulnerability exists in the Just-In-Time (JIT) compiler component of the Mozilla JavaScript Engine. The flaw is rooted in a JIT miscompilation, where the compiler incorrectly optimizes code, leading to memory corruption when an object is accessed after it has been freed. An attacker can exploit this by enticing a user to visit a specially crafted website or view a malicious email, triggering the miscompilation. This can result in arbitrary code execution within the context of the application. The vulnerability is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla Thunderbird < 148, < 140.8
- Red Hat Enterprise Linux Server (v. 7 ELS) 7
Timeline
- 2026-02-24: disclosed
- 2026-02-24: patched
- 2026-02-24: advisory
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2012608
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338