CVE-2026-16392

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

A JIT miscompilation vulnerability exists in the JavaScript Engine component of Firefox and Thunderbird. It was fixed in version 153 of both products.

Risk Assessment

The JIT miscompilation could allow a remote attacker to execute arbitrary code in the context of the browser or mail client, potentially leading to system compromise.

Recommendation

Update Firefox and Thunderbird to version 153 or later.

Original NVD description (English source)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.