CVE-2026-100814: Firefox JIT Buffer Overflow Vulnerability

CVE-2026-100814 Overview

CVE-2026-100814 is a boundary condition flaw in the Just-In-Time (JIT) compiler of the JavaScript engine used by Mozilla Firefox and Thunderbird. The issue affects how the JIT component computes memory bounds during code generation, allowing memory corruption to occur when compiled JavaScript is executed. Mozilla addressed the defect in Firefox 157, Firefox ESR 153.4, Thunderbird 157, and Thunderbird 153.4. An attacker can trigger the vulnerability by convincing a user to load a crafted web page or HTML email, resulting in code execution in the browser or mail client process. The weakness is tracked under CWE-119, improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers can execute arbitrary code in the context of the Firefox or Thunderbird process by luring a user to visit a malicious page or open a crafted message.

Affected Products

Mozilla Firefox versions prior to 157
Mozilla Firefox ESR versions prior to 153.4
Mozilla Thunderbird versions prior to 157 and 153.4

Discovery Timeline

2026-09-29 - CVE-2026-100814 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100814

Vulnerability Analysis

The defect resides in the JIT tier of the JavaScript engine, which translates hot JavaScript functions into native machine code for performance. Incorrect boundary conditions during this translation cause the compiler to generate code that reads or writes outside intended memory limits. When a crafted script triggers the vulnerable optimization path, the resulting native code corrupts adjacent memory in the content process. Because JIT-emitted code runs with the same privileges as the host process, successful exploitation yields arbitrary code execution inside the browser sandbox. In Thunderbird, scripting is disabled in message display by default, but attack surface remains through browser-like contexts and RSS content.

Root Cause

The root cause is a boundary condition error [CWE-119] in the JIT compiler's bounds checking or offset calculation logic. The compiler emits machine code that fails to correctly validate the range of an index or length before performing a memory access. This class of bug typically stems from incorrect assumptions about type feedback, escape analysis, or range analysis performed during speculative optimization.

Attack Vector

Exploitation requires network delivery and user interaction. An attacker hosts a web page containing crafted JavaScript designed to force the JIT compiler down the vulnerable code path. Once the victim navigates to the page, the engine compiles and executes the payload, corrupting memory to gain control of execution. The same technique can be delivered through advertising networks, compromised sites, or embedded frames.

No public proof-of-concept code is available. Refer to Mozilla Bug Report #2068385 and Mozilla Security Advisory MFSA-2026-97 for vendor-provided technical detail.

Detection Methods for CVE-2026-100814

Indicators of Compromise

Firefox or Thunderbird processes spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or sh.
Crashes in the content process referencing JIT-generated code regions or executable anonymous mappings.
Outbound network connections from the browser process to previously unseen infrastructure shortly after visiting an untrusted page.

Detection Strategies

Inventory endpoints running Firefox or Thunderbird and flag any version below 157 (or ESR below 153.4) as vulnerable.
Monitor for browser process memory anomalies, unexpected RWX mappings, and abnormal thread creation patterns consistent with JIT exploitation.
Correlate web proxy logs with EDR telemetry to identify users who visited suspicious sites immediately before browser instability.

Monitoring Recommendations

Alert on Firefox and Thunderbird spawning shells, script interpreters, or LOLBins.
Track file writes by the browser process into autostart, scheduled task, or profile-adjacent locations.
Ingest browser crash telemetry into the SIEM and threshold-alert on repeated JIT-related crashes across the fleet.

How to Mitigate CVE-2026-100814

Immediate Actions Required

Upgrade Firefox to 157 or later and Firefox ESR to 153.4 or later on all managed endpoints.
Upgrade Thunderbird to 157 or 153.4 or later across all mail clients.
Prioritize workstations used for general web browsing, contractor devices, and any host processing untrusted email.

Patch Information

Mozilla fixed the vulnerability in the releases referenced by MFSA-2026-97, MFSA-2026-100, MFSA-2026-101, and MFSA-2026-103. Fixed versions are Firefox 157, Firefox ESR 153.4, Thunderbird 157, and Thunderbird 153.4. Deploy through your existing software management tooling and validate the installed build after reboot.

Workarounds

Disable the JavaScript JIT via the javascript.options.baselinejit and javascript.options.ion preferences in about:config where patching is delayed. Expect measurable performance impact.
Enforce script blocking on untrusted origins through enterprise policy, NoScript, or equivalent content-filtering extensions.
Restrict browser process capabilities using OS-level exploit mitigations and network egress controls until patching completes.

bash

# Firefox enterprise policy example (policies.json) to force update channel
{
  "policies": {
    "AppAutoUpdate": true,
    "DisableAppUpdate": false,
    "OverrideFirstRunPage": "",
    "Preferences": {
      "javascript.options.ion": { "Value": false, "Status": "locked" },
      "javascript.options.baselinejit": { "Value": false, "Status": "locked" }
    }
  }
}