PT-2026-27397 · Mozilla · Firefox+2

Maxpl0It · Published 2026-01-01 · Updated 2026-04-04 · CVE-2026-4698

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 149 Firefox ESR versions prior to 115.34 and 140.9 Thunderbird versions prior to 149 and 140.9

Description: A flaw exists in the JavaScript Engine's JIT component, specifically a JIT miscompilation issue. This can lead to potential security risks.

Recommendations: Update Firefox to version 149 or later. Update Firefox ESR to version 115.34 or later, or 140.9 or later. Update Thunderbird to version 149 or later, or 140.9 or later.

Fix

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALSA-2026:5930

ALSA-2026:5931

ALSA-2026:5932

ALSA-2026:6188

ALSA-2026:6342

CVE-2026-4698

MGASA-2026-0080

MGASA-2026-0081

OPENSUSE-SU-2026:10413-1

OPENSUSE-SU-2026:10447-1

OPENSUSE-SU-2026:10458-1

OPENSUSE-SU-2026:20439-1

SUSE-SU-2026:1126-1

SUSE-SU-2026:1127-1

SUSE-SU-2026:1163-1

ZDI-26-252

Affected Products

Firefox

Firefox Esr

Thunderbird

References · 191

• https://osv.dev/vulnerability/MGASA-2026-0081 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2026-24 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20439-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2026-24/#CVE-2026-4698 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2026-22 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-21 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10458-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:6188 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-24 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-5930.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4698 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1126-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-5932.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1127-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0081.html · Security Note