{"id":"CVE-2026-117942","kind":"vulnerability","aliases":["CVE-2026-117942"],"related":[],"title":"Firefox: JavaScript JIT boundary bug could let web content run code","description":"Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Incorrect boundary checks in the JIT compiler of Firefox's JavaScript engine were found. The sources do not say what an attacker gets beyond the general risk of a memory-safety flaw in the JIT.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","package"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version with Help > About Firefox, or `firefox --version`\n- Compare against the fixed releases: `159`, `115.44` (ESR) and `153.6` (ESR)","fix":"- Update Firefox to `159`, or to ESR `115.44` or `153.6` if you run an ESR channel","status":"open","published_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:35:46+00:00","updated_at":"2026-10-27T14:35:46+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-27T14:35:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159`, or to ESR `115.44` or `153.6` if you run an ESR channel","reach":"internet","title":"Firefox: JavaScript JIT boundary bug could let web content run code","impact":"high","summary":"Incorrect boundary checks in the JIT compiler of Firefox's JavaScript engine were found. The sources do not say what an attacker gets beyond the general risk of a memory-safety flaw in the JIT.","category":"package","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact","analyst_note":"Check the Mozilla security advisory for this CVE for severity, exploitability and whether the flaw is reachable from web content.","how_to_check":"- Check the installed Firefox version with Help > About Firefox, or `firefox --version`\n- Compare against the fixed releases: `159`, `115.44` (ESR) and `153.6` (ESR)","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox builds older than the fixed releases, including desktop installs and managed fleets that pin a version. The sources do not say whether the flaw needs any particular page, setting or feature to be reached. Teams that only run Firefox ESR on the listed fixed lines should confirm they are on a patched build.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000595,"input_tokens":3268,"output_tokens":537,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117942':14A,17A '-2026':13A,16A '115.44':76C '153.6':80C '159':73C 'attack':43B 'beyond':45B 'boundari':4A,23B,59C 'browser':18B 'bug':5A 'check':24B 'code':11A 'compil':28B 'compon':66C 'condit':60C 'content':9A 'could':6A 'cve':12A,15A 'desktop':19B 'engin':33B,64C 'esr':75C,79C 'firefox':1A,20B,30B,72C,74C,78C 'fix':70C 'flaw':54B 'found':35B 'general':47B 'get':44B 'incorrect':22B,58C 'javascript':2A,32B,63C 'jit':3A,27B,57B,65C 'let':7A 'memori':52B 'memory-safeti':51B 'packag':21B 'risk':48B 'run':10A 'safeti':53B 'say':40B 'sourc':37B 'vulner':68C 'web':8A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than the fixed releases, including desktop installs and managed fleets that pin a version. The sources do not say whether the flaw needs any particular page, setting or feature to be reached. Teams that only run Firefox ESR on the listed fixed lines should confirm they are on a patched build.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117942","severity":null,"published_at":"2026-10-27T14:16:49+00:00","modified_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}