---
id: "CVE-2026-117942"
kind: "vulnerability"
aliases: ["CVE-2026-117942"]
title: "Firefox: JavaScript JIT boundary bug could let web content run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "package"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-10-27T14:16:49+00:00"
first_seen_at: "2026-10-27T14:32:23+00:00"
updated_at: "2026-10-27T14:35:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117942", "first_seen_at": "2026-10-27T14:32:23+00:00"}]
---

# Firefox: JavaScript JIT boundary bug could let web content run code

Incorrect boundary checks in the JIT compiler of Firefox's JavaScript engine were found. The sources do not say what an attacker gets beyond the general risk of a memory-safety flaw in the JIT.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version with Help > About Firefox, or `firefox --version`
- Compare against the fixed releases: `159`, `115.44` (ESR) and `153.6` (ESR)

## Fix

- Update Firefox to `159`, or to ESR `115.44` or `153.6` if you run an ESR channel

## Timeline

- 2026-10-27T14:32:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117942

## From the sources

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_