CVE-2026-4698
Critical · CVSS 9.8Mozilla Firefox / Thunderbird JavaScript Engine (SpiderMonkey JIT) — JIT miscompilation type confusion (CWE-843)
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-843, CWE-843, CWE-733
Description
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Search profile — drives PoC discovery
Symbols JITSpiderMonkeyIonMonkeyWarpMonkeyMIRJitCompileTypeSetMIRTypejsop_*js::jitCacheIRWarpIonBuilderBaselineCompilermfsa2026-20mfsa2026-21mfsa2026-22mfsa2026-23bug2020906
Keywords CVE-2026-4698Firefox JIT miscompilationSpiderMonkey type confusionFirefox 149 JIT vulnerabilityFirefox ESR 115.34 JITFirefox ESR 140.9 JITThunderbird 149 JITmfsa2026-20mfsa2026-21bugzilla 2020906CWE-843 FirefoxJIT miscompilation PoCSpiderMonkey CWE-843
Versions: Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, Thunderbird < 140.9
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2020906
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-21/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/errata/RHSA-2026:5930
- https://access.redhat.com/errata/RHSA-2026:5931
- https://access.redhat.com/errata/RHSA-2026:5932
- https://access.redhat.com/errata/RHSA-2026:6188
- https://access.redhat.com/errata/RHSA-2026:6342
- https://access.redhat.com/errata/RHSA-2026:6917
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T12:30:14.000Z