CVE-2026-16355

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

JIT miscompilation in the JavaScript Engine leads to incorrect code execution. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Risk Assessment

An attacker could exploit this flaw to achieve remote code execution or data integrity compromise in the browser or mail client.

Recommendation

Immediately update Firefox and Thunderbird to the versions specified in the description.

Original NVD description (English source)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.