Executive brief
Firefox ESR, Mozilla's long-term support web browser used by enterprises and privacy-conscious users, contains a use-after-free vulnerability in its JavaScript JIT compiler. An attacker could exploit this flaw by crafting a malicious web page that, when visited, could crash the browser or potentially execute arbitrary code with the privileges of the user viewing the page.
Technical details
This vulnerability is a use-after-free flaw in the JavaScript Engine's JIT (Just-In-Time) compilation component. The root cause involves memory being accessed after it has been freed, which can occur during JavaScript execution in the JIT compiler. The attack vector is network-based; an attacker needs only to deliver a malicious webpage to a victim browser. No authentication or special user interaction beyond visiting a webpage is required. Successful exploitation could lead to information disclosure, denial of service, or arbitrary code execution. The vulnerability was patched in Firefox ESR 140.16.
Affected products
- Mozilla Firefox ESR before 140.16
- Mozilla Thunderbird before 140.16
Timeline
- 2026-09-15: disclosed: Vulnerability publicly disclosed via Mozilla Security Advisory MFSA2026-92
- 2026-09-15: patched: Fixed in Firefox ESR 140.16 and Thunderbird 140.16