{"id":"CVE-2026-124939","kind":"vulnerability","aliases":["CVE-2026-124939"],"related":[],"title":"Firefox: JIT miscompilation in JavaScript engine may allow code execution","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.","summary":"A JIT compiler bug in Firefox's JavaScript engine can produce incorrect machine code when scripts run. Sources do not state the attacker outcome beyond the miscompilation itself.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","firefox","runtime"],"not_affected_if":["up-to-date-firefox"],"how_to_check":"- Check the installed Firefox version in About Firefox or with `firefox --version`\n- Check whether Firefox ESR is in use and its version","fix":"- Firefox: `160` or later\n- Firefox ESR: `153.7` or later","status":"open","published_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","triaged_at":"2026-11-10T14:24:08+00:00","updated_at":"2026-11-10T14:24:08+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T14:24:08Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160` or later\n- Firefox ESR: `153.7` or later","reach":"internet","title":"Firefox: JIT miscompilation in JavaScript engine may allow code execution","impact":"medium","summary":"A JIT compiler bug in Firefox's JavaScript engine can produce incorrect machine code when scripts run. Sources do not state the attacker outcome beyond the miscompilation itself.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["firefox","browsers"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and Mozilla's advisory for the exploit conditions, user interaction and worst-case impact.","how_to_check":"- Check the installed Firefox version in About Firefox or with `firefox --version`\n- Check whether Firefox ESR is in use and its version","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later.","product_name":"","needs_analyst":true,"not_affected_if":["up-to-date-firefox"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions. Sources do not describe any server-side or configuration-dependent exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4486,"output_tokens":506,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124939':13A,16A '-2026':12A,15A '153.7':65C '160':61C 'allow':8A 'attack':42B 'beyond':44B 'browser':17B 'bug':23B 'code':9A,33B 'compil':22B 'compon':54C 'cve':11A,14A 'engin':6A,28B,52C 'esr':64C 'execut':10A 'firefox':1A,18B,25B,60C,63C 'fix':58C 'incorrect':31B 'javascript':5A,27B,51C 'jit':2A,21B,47C,53C 'machin':32B 'may':7A 'miscompil':3A,46B,48C 'outcom':43B 'produc':30B 'run':36B 'runtim':19B 'script':35B 'sourc':37B 'state':40B 'vulner':56C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions. Sources do not describe any server-side or configuration-dependent exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or Firefox ESR to 153.7 or later.","pkeys":[],"ptokens":[],"labels":["browsers","firefox","runtime","unknown"],"campaign_type":null,"search_a":"'-124939':13A,16A '-2026':12A,15A 'allow':8A 'code':9A 'cve':11A,14A 'engin':6A 'execut':10A 'firefox':1A 'javascript':5A 'jit':2A 'may':7A 'miscompil':3A","search_b":"'attack':42B 'beyond':44B 'browser':17B 'bug':23B 'code':33B 'compil':22B 'engin':28B 'firefox':18B,25B 'incorrect':31B 'javascript':27B 'jit':21B 'machin':32B 'miscompil':46B 'outcom':43B 'produc':30B 'run':36B 'runtim':19B 'script':35B 'sourc':37B 'state':40B","search_c":"'153.7':65C '160':61C 'compon':54C 'engin':52C 'esr':64C 'firefox':60C,63C 'fix':58C 'javascript':51C 'jit':47C,53C 'miscompil':48C 'vulner':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124939","severity":null,"published_at":"2026-11-10T14:17:28+00:00","modified_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","fetched_at":"2026-11-10T14:22:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}