Loading vulnerability…
JavaScript JIT miscompilation in Firefox and Thunderbird
CVE-2026-16355 is a miscompilation vulnerability in the JavaScript engine's just-in-time (JIT) compiler used by Mozilla Firefox and Thunderbird. The flaw affects JavaScript compilation correctness; the specific compiler operation, triggering input, and downstream security consequences are not established. Fixes are included in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The specific downstream impact of CVE-2026-16355 is not stated beyond security impact arising from JIT miscompilation in Firefox's JavaScript engine.
If you can’t patch tonight, do this now.
No temporary workaround is specified. Restrict exposure to untrusted web and message content until the affected Mozilla product is updated.
Patch, then assume compromise.
Upgrade to Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, or Thunderbird 140.13, or a later security-maintained release of the applicable branch. On Debian 13 (trixie), upgrade firefox-esr to 140.13.0esr-1~deb13u1 or later, and thunderbird to 1:140.13.0esr-2~deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.