CVE-2026-109721

—Unscored

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

—Unscored

Attack vector: —
Complexity: —
Privileges needed: —
User interaction: —
Impact: —
Weakness: —

Impact

Attackers can potentially execute arbitrary code or crash the application by convincing a user to open a malicious link or email. This requires user interaction to visit a webpage or view hostile content.

Root cause

The JavaScript JIT compiler incorrectly checks boundary conditions during execution.

Affected systems

Firefox versions prior to 158, Firefox ESR prior to 153.5, Thunderbird versions prior to 158, and Thunderbird ESR prior to 153.5.

Fix & remediation

Upgrade to Firefox 158, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5; no interim mitigation is provided.

shell

$ sudo apt-get update && sudo apt-get --only-upgrade install firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109721