CVE-2026-4698

The JIT (Just-In-Time compilation) component of the JavaScript engine performs incorrect code compilation, leading to a situation where a memory value is interpreted as a different type than what was actually assigned to it (type confusion, CWE-843). An attacker can craft malicious JavaScript code and trick the victim into visiting a controlled website or opening a malicious message, which triggers the faulty JIT compilation process. As a result, arbitrary operations can be executed in the context of the browser or email client process.

An attacker can achieve full remote code execution (RCE) on the victim's machine, potentially gaining the ability to compromise confidentiality, integrity, and availability of the system at the highest level.

Software should be updated immediately to the following versions: Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149 or Thunderbird 140.9, in which the bug has been fixed by the vendor.

Mozilla Firefox versions before 149, Mozilla Firefox ESR versions before 115.34 and before 140.9, Mozilla Thunderbird versions before 149 and before 140.9.