CVE-2026-16355: Firefox JavaScript Engine RCE Vulnerability

CVE-2026-16355 Overview

CVE-2026-16355 is a Just-In-Time (JIT) miscompilation vulnerability in the JavaScript engine used by Mozilla Firefox and Thunderbird. The flaw resides in the JIT compiler component, which converts JavaScript into optimized native code at runtime. A miscompilation produces incorrect machine code that can lead to type confusion [CWE-843] during script execution. An attacker who convinces a user to load a crafted web page can trigger the flaw and gain code execution in the content process. Mozilla fixed the issue in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Critical Impact
Remote attackers can achieve arbitrary code execution by serving crafted JavaScript to unpatched Firefox and Thunderbird clients.

Affected Products

Mozilla Firefox versions prior to 153
Mozilla Firefox ESR versions prior to 115.38 and 140.13
Mozilla Thunderbird versions prior to 153 and 140.13

Discovery Timeline

2026-07-21 - CVE-2026-16355 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16355

Vulnerability Analysis

The vulnerability lives in the SpiderMonkey JIT compiler that powers Firefox and Thunderbird JavaScript execution. During optimization, the JIT generates native code based on assumptions about operand types and object shapes. A miscompilation causes the generated code to operate on data as if it were a different type than what memory actually holds. This mismatch is classified as type confusion under [CWE-843]. Type confusion in a JIT context is especially dangerous because generated code executes with the privileges of the browser content process and often manipulates raw pointers.

Root Cause

The root cause is faulty optimization logic in the JavaScript engine's JIT component. The compiler emits machine code that violates the runtime type invariants the engine relies on for memory safety. When the miscompiled path executes, JavaScript objects can be reinterpreted, enabling attacker-controlled reads, writes, or control-flow redirection.

Attack Vector

Exploitation requires no authentication and no user interaction beyond visiting a page. An attacker hosts malicious JavaScript on a website or delivers it inside HTML email rendered by Thunderbird. When the JIT compiles the crafted script, the miscompilation triggers, giving the attacker a primitive to escalate toward arbitrary code execution inside the renderer sandbox. Further sandbox escape techniques would be needed to reach the underlying operating system.

See the Mozilla Bug Report #2052207 and advisories MFSA-2026-68 through MFSA-2026-72 for vendor technical details.

Detection Methods for CVE-2026-16355

Indicators of Compromise

Unexpected child processes spawned by firefox.exe, firefox, or thunderbird binaries following browsing activity.
Crash reports referencing js::jit frames or IonMonkey in Firefox or Thunderbird telemetry.
Outbound connections from browser processes to previously unseen domains hosting heavily obfuscated JavaScript.

Detection Strategies

Inventory endpoint browser versions and flag hosts still running Firefox below 153, Firefox ESR below 115.38 or 140.13, or Thunderbird below 140.13 or 153.
Hunt for shellcode-like behavior in browser processes, including RWX memory allocations followed by execution and suspicious module loads.
Correlate proxy or DNS telemetry with browsing to newly registered domains that serve large JIT-spraying JavaScript payloads.

Monitoring Recommendations

Forward browser process telemetry, including child process creation and memory protection changes, to a central analytics platform for behavioral review.
Alert on Firefox or Thunderbird processes writing executables, scripts, or scheduled task artifacts to disk.
Track Mozilla advisory feeds and internal patch compliance dashboards to close exposure windows quickly.

How to Mitigate CVE-2026-16355

Immediate Actions Required

Upgrade Firefox to version 153 or later on all managed endpoints.
Upgrade Firefox ESR to 115.38 or 140.13, matching the deployed ESR channel.
Upgrade Thunderbird to 153, or Thunderbird ESR to 140.13.
Restart browsers after patching to ensure the vulnerable JIT code is unloaded from memory.

Patch Information

Mozilla addressed the miscompilation across five advisories: MFSA-2026-68, MFSA-2026-69, MFSA-2026-70, MFSA-2026-71, and MFSA-2026-72. Administrators should deploy the fixed builds through their standard software distribution channels. Details of the underlying defect are tracked in Mozilla Bug 2052207.

Workarounds

Disable the JavaScript JIT by setting javascript.options.ion and javascript.options.baselinejit to false in about:config until patches are applied. This reduces performance but limits the attack surface.
Configure Thunderbird to render messages as plain text to prevent inline JavaScript execution paths from reaching the JIT.
Restrict browsing to trusted sites through enterprise proxy or DNS filtering while patch rollout completes.

bash

# Configuration example: enforce Firefox JIT hardening via enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "javascript.options.ion":         { "Value": false, "Status": "locked" },
      "javascript.options.baselinejit": { "Value": false, "Status": "locked" }
    },
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}