CVE-2026-4702
Published: 24 March 2026
Description
JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely remediation of the JIT miscompilation flaw through installation of patches released in Firefox 149, ESR 140.9, and Thunderbird equivalents.
Enables scanning and monitoring to identify systems running vulnerable versions of Firefox or Thunderbird affected by the JavaScript Engine miscompilation.
Ensures receipt and dissemination of Mozilla security advisories like MFSA2026-20, facilitating awareness and prompt patching of the vulnerability.
Security SummaryAI
CVE-2026-4702 is a JIT miscompilation vulnerability in the JavaScript Engine component of Mozilla products. It affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird versions prior to 140.9. The vulnerability, published on 2026-03-24, is classified under CWE-843 and carries a CVSS v3.1 base score of 9.8.
The vulnerability can be exploited by a remote attacker with network access, requiring low attack complexity, no privileges, and no user interaction. Exploitation results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) with no change in scope.
Mozilla security advisories, including MFSA2026-20, MFSA2026-22, MFSA2026-23, and MFSA2026-24, along with Bugzilla entry 2013560, confirm the issue was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Security practitioners should prioritize updating affected products to these versions or later to mitigate the risk.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote JIT miscompilation RCE in browser JS engine with no privileges/user interaction directly enables drive-by compromise (T1189) and client application exploitation for code execution (T1203).