CVE-2026-94448
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
When a JavaScript template literal contains consecutive expressions, context tracking state was not properly reset upon entering a new expression. Now template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Risk Assessment
Incorrect recognition of regular expressions could lead to improper escaping, potentially causing code errors or security vulnerabilities.
Recommendation
Upgrade to the patched version. Test code using template literals with regular expressions.
Other vulnerabilities in JavaScript engine
See all- CVE-2026-2786Critical
CVE-2026-2786 involves a use-after-free vulnerability in the JavaScript Engine component. It has been fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CVE-2026-2763Critical
A use-after-free vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. It is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CVE-2026-8391Medium
An unspecified vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. The flaw is fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Original NVD description (English source)
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS