Back to overview

CVE-2026-16392

CRITICAL
9.1
CVSS 3.1
Description
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Metadata

CVE ID
CVE-2026-16392
State
PUBLISHED
Assigner
mozilla
Reserved
2026-07-20 21:57 UTC
Published
2026-07-21 12:38 UTC
Last updated
2026-07-28 14:56 UTC
Primary CWE
CWE-670
CWE-670 Always-Incorrect Control Flow Implementation
Vendor / Product
Mozilla / Firefox
Sources
cve.org  ·  NVD

Severity & Metrics

9.1 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
partial
Affected products (2)
VendorProductPlatformVersions
Mozilla Firefox — 153 ≤ *
Mozilla Thunderbird — 153 ≤ *
Weakness (CWE)
CWESourceDescription
CWE-670 adp CWE-670 Always-Incorrect Control Flow Implementation
CWE-843 adp CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.1 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References (3)
Back to overview