CVE-2026-100814
HighCVSS 8.8Summary
Incorrect boundary conditions in the JavaScript Engine: JIT component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Risk Assessment
Boundary errors could lead to unexpected behavior, crashes, or potential code execution, potentially exposing the system to attacks.
Recommendation
Update Firefox or Thunderbird to the patched versions.
Other vulnerabilities in Firefox
See all- CVE-2026-100832High
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.
- CVE-2026-100831High
Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100825High
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100824High
Privilege escalation vulnerability in the Places component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100820High
Privilege escalation vulnerability in the Address Bar component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100815High
Use-after-free vulnerability in the CSS Parsing and Computation component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100813High
Invalid pointer in the JavaScript Engine: JIT component. Fixed in Thunderbird 157 and Firefox 157.
- CVE-2026-100807High
Privilege escalation vulnerability in the DOM: Service Workers component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100805High
Race condition and use-after-free vulnerability in the Audio/Video component. Fixed in Thunderbird 157 and Firefox 157.
- CVE-2026-100801High
Privilege escalation vulnerability in the DLL Services component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Original NVD description (English source)
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS