CVE-2026-4702

The vulnerability classified as CWE-843 (Type Confusion) involves incorrect handling of data types by the JavaScript engine JIT compiler. A JIT compilation error can lead to a situation where JavaScript code executed in the browser operates on data in a manner inconsistent with their actual type. An attacker can craft malicious JavaScript code and deliver it to a victim, for example by visiting an appropriately prepared website or opening an email message containing a malicious script.

Successful exploitation of the vulnerability may allow an attacker to gain full control over the confidentiality, integrity, and availability of the system, including potentially remote code execution (RCE) in the context of the application.

Mozilla Firefox should be updated to version 149 or later, Mozilla Firefox ESR to version 140.9 or later, Mozilla Thunderbird to version 149 or later, and Mozilla Thunderbird ESR to version 140.9 or later. Details are available in Mozilla security advisories (mfsa2026-20, mfsa2026-22, mfsa2026-23, mfsa2026-24).

Mozilla Firefox versions prior to 149, Mozilla Firefox ESR versions prior to 140.9, Mozilla Thunderbird versions prior to 149, and Mozilla Thunderbird ESR versions prior to 140.9.