Cyber Posture

CVE-2026-4702

Critical

Published: 24 March 2026

Published
24 March 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0003 7.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the CVE by requiring timely remediation of the JIT miscompilation flaw through installation of patches released in Firefox 149, ESR 140.9, and Thunderbird equivalents.

detect

Enables scanning and monitoring to identify systems running vulnerable versions of Firefox or Thunderbird affected by the JavaScript Engine miscompilation.

prevent

Ensures receipt and dissemination of Mozilla security advisories like MFSA2026-20, facilitating awareness and prompt patching of the vulnerability.

Security SummaryAI

CVE-2026-4702 is a JIT miscompilation vulnerability in the JavaScript Engine component of Mozilla products. It affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird versions prior to 140.9. The vulnerability, published on 2026-03-24, is classified under CWE-843 and carries a CVSS v3.1 base score of 9.8.

The vulnerability can be exploited by a remote attacker with network access, requiring low attack complexity, no privileges, and no user interaction. Exploitation results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) with no change in scope.

Mozilla security advisories, including MFSA2026-20, MFSA2026-22, MFSA2026-23, and MFSA2026-24, along with Bugzilla entry 2013560, confirm the issue was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Security practitioners should prioritize updating affected products to these versions or later to mitigate the risk.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 140.9.0 · ≤ 149.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Remote JIT miscompilation RCE in browser JS engine with no privileges/user interaction directly enables drive-by compromise (T1189) and client application exploitation for code execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References