CVE-2026-109722

8.1High

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality, integrity
Weakness: CWE-670

Impact

Remote attackers can compromise confidentiality and integrity if a user visits a malicious webpage or opens a crafted email. Exploitation requires user interaction with untrusted content.

Root cause

A JIT miscompilation flaw in the JavaScript engine produces incorrect machine code during execution.

Affected systems

Firefox versions before 158, Firefox ESR before 115.43 and 153.5, and Thunderbird before 158 and 153.5.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade to Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim mitigation is provided.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109722