Executive brief
A vulnerability in the Firefox web browser's JavaScript engine could allow an attacker to execute malicious code on a user's computer. This occurs when the browser incorrectly processes extremely large scripts, leading to a memory corruption state. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially resulting in full system compromise or unauthorized data access.
Technical details
A JIT miscompilation vulnerability exists in the SpiderMonkey JavaScript engine's BaselineJIT component due to bitfield truncation of the pcOffset. While the main-thread entry path (CanEnterBaselineJIT) enforced a script length limit (BaselineMaxScriptLength), the eager off-thread baseline-compile path lacked this check. When a script exceeds 256MB, the 28-bit pcOffset_ bitfield in RetAddrEntry is truncated. During exception unwinding, this truncated offset is converted back to an incorrect but in-bounds bytecode pointer. This leads to incorrect try-note matching in HandleExceptionBaseline, resulting in type confusion when a non-object stack slot is treated as a JSObject. The issue is fixed in Firefox 150.0.3 by ensuring script length validation is performed on all compilation paths.
Affected products
- Mozilla Firefox versions up to (excluding) 150.0.3
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-12: patched: Fixed in Firefox 150.0.3