Skip to main content

Mozilla Firefox EUVDEUVD-2026-46248

| CVE-2026-16410 CRITICAL
Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)
2026-07-21 mozilla GHSA-wqgp-6hgv-r9qf
Information Disclosure Memory Corruption Red Hat Mozilla
Critical
Disputed · 9.8 Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious web page
  2. Delivery
    Serve crafted JavaScript payload
  3. Exploit
    Trigger JIT type-confusion miscompilation
  4. Execution
    Corrupt content-process memory
  5. Impact
    Disclose data or execute code

Vulnerability Assessment

Weakness
CWE
CWE-843
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to load attacker-controlled JavaScript in a Firefox build older than 153 with the JIT enabled (the default configuration), and to reach the specific code path that triggers the miscompilation in the JavaScript Engine JIT component. The CVSS marks UI:N, but as a browser engine bug it realistically depends on the user navigating to malicious or compromised web content - this navigation is the primary limiting factor, along with content-process sandboxing which constrains what a successful exploit can reach without an additional sandbox escape. No authentication is required (PR:N). Disabling JIT (about:config ion/baselinejit prefs) removes the prerequisite and blocks exploitation.
Impact

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 (Critical): network-reachable, low complexity, no privileges, no user interaction beyond visiting a page, with high confidentiality, integrity, and availability impact. However, EPSS is only 0.13% (3rd percentile), the CVE is not on CISA KEV, and no POC is referenced - so real-world exploitation risk is currently far lower than the raw score implies. There is tension worth noting: the UI:N metric is arguably optimistic for a browser bug, since exploitation typically requires the victim to navigate to attacker content (drive-by), which is trivially achievable but is still a form of interaction; treat the 9.8 as a worst-case ceiling. Browser JIT type-confusion bugs are historically high-value and frequently weaponized into full exploit chains, so despite the low EPSS this should be patched promptly, especially on internet-facing user endpoints.
Exploit ScenarioDerived

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) containing crafted JavaScript that forces the SpiderMonkey JIT into a type-confusion miscompilation. When a victim running a pre-153 Firefox visits the page, the corrupted machine code corrupts browser memory, letting the attacker read sensitive process data or attempt code execution in the content process. No POC is publicly identified at time of analysis, but the network vector and low complexity make drive-by delivery straightforward.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.

RemediationAI

Vendor-released patch: Firefox 153. Upgrade all Firefox installations to version 153 or later, which resolves the JIT miscompilation per Mozilla advisories MFSA2026-68 (https://www.mozilla.org/security/advisories/mfsa2026-68/) and MFSA2026-71 (https://www.mozilla.org/security/advisories/mfsa2026-71/); confirm ESR/mobile fixed versions against Mozilla if those channels are in use. Because Firefox auto-updates, ensure the update mechanism is not disabled by policy and force a restart to apply. As an interim compensating control before patching, disabling the JIT compiler removes the vulnerable code path - set javascript.options.baselinejit, javascript.options.ion, and related prefs to false in about:config (or via enterprise policy), accepting a significant JavaScript performance penalty on heavy web apps; alternatively, restrict browsing to trusted sites or deploy script-blocking (e.g., NoScript) to reduce exposure to attacker-controlled JavaScript, at the cost of breaking sites that depend on scripting.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in Firefox's SpiderMonkey JavaScript engine, specifically the Just-In-Time (JIT) compiler that translates hot JavaScript into optimized native machine code. CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion') is the root-cause class: the JIT makes an incorrect assumption about the type of a JavaScript value and emits machine code that operates on it as the wrong type, producing a miscompilation. Because JIT-generated code runs without the runtime type checks of the interpreter, such miscompilations let attacker-controlled script read or write memory outside intended bounds. The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms the affected product is the Firefox browser application across versions prior to the 153 fix. Mozilla tags classify the impact as Information Disclosure and Memory Corruption.

Know when Mozilla gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)
Vendor (mozilla) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Network-delivered malicious JavaScript with no privileges, but realistically requires the victim to visit attacker content, so UI:R; JIT memory corruption yields high C/I/A within the content process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE CRITICAL
Red Hat 3.4 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 22, 2026 - 19:22 NVD
9.8 (CRITICAL)
CVE Published
Jul 21, 2026 - 12:38 cve.org
CRITICAL 9.8
CVE Published
Jul 21, 2026 - 12:38 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153.

Executive ViewAI

Why It Matters

A critical memory corruption vulnerability in Firefox's JavaScript engine allows remote attackers to execute code or steal data by serving malicious web pages to Firefox users. With a 9.8 CVSS score and no observed active exploitation, this poses a significant risk to any organization where employees use Firefox, particularly if they visit untrusted or compromised websites.

Business Impact: Severe
Compensating Controls

Apply vendor patch: Firefox 153 or later.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Ubiquitous
Firefox is one of the most widely deployed desktop web browsers globally
Social Media
2
Sightings
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Mozilla

View all
CVE-2015-4495 HIGH POC
8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2013-0643 HIGH
8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all
CVE-2011-0611 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2017-8291 HIGH POC
7.8
CVE-2016-7201 HIGH POC
8.8
CVE-2017-0037 HIGH POC
8.1
CVE-2019-0752 HIGH POC
7.5
CVE-2017-5070 HIGH POC
8.8
CVE-2023-3079 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

References

Advisories & patches
REF https://bugzilla.mozilla.org/show_bug.cgi?id=2053680 REF https://www.mozilla.org/security/advisories/mfsa2026-68/ REF https://www.mozilla.org/security/advisories/mfsa2026-71/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy