critical advisory March 24, 2026

Firefox and Thunderbird JIT Miscompilation Vulnerability (CVE-2026-4698)

A critical JIT miscompilation vulnerability (CVE-2026-4698) in the JavaScript engine affects Firefox and Thunderbird, potentially leading to remote code execution.

CVE-2026-4698 describes a JIT miscompilation vulnerability within the JavaScript engine’s JIT component in Mozilla Firefox and Thunderbird. Specifically, Firefox versions prior to 149, Firefox ESR versions less than 115.34 and 140.9, and Thunderbird versions before 149 and 140.9 are affected. This vulnerability stems from a type confusion issue (CWE-843) during JavaScript code compilation, which an attacker can exploit to potentially execute arbitrary code on a vulnerable system. Given the…

Detection coverage 2

Detect Firefox Crash Due To JIT Miscompilation

high

Detects potential exploitation of JIT miscompilation vulnerabilities in Firefox by monitoring for crash events associated with the JIT compiler.

sigma tactics: execution techniques: T1059.007 sources: application, windows

Detect Thunderbird Crash Due To JIT Miscompilation

high

Detects potential exploitation of JIT miscompilation vulnerabilities in Thunderbird by monitoring for crash events associated with the JIT compiler.

sigma tactics: execution techniques: T1059.007 sources: application, windows

Detection queries are kept inside the platform. Get full rules →