JIT miscompilation in the JavaScript Engine: JIT component
Published Jul 21, 2026
9.8
CRITICALCVSS 3.1
EPSS 0.40%
Description
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Affected products
No data.
- < 115.38.0
- < 153.0.0
- ≥ 128.1.0 · < 140.13.0
- < 140.13.0
- ≥ 141.0 · < 153.0
No data.
Red Hat Enterprise Linux 10
firefox-0:140.13.0-1.el10_2
Fixed · RHSA-2026:47101
Red Hat Enterprise Linux 10
thunderbird-0:140.13.0-1.el10_2
Fixed · RHSA-2026:49621
Red Hat Enterprise Linux 10.0 Extended Update Support
firefox-0:140.13.0-1.el10_0
Fixed · RHSA-2026:54181
Red Hat Enterprise Linux 10.0 Extended Update Support
thunderbird-0:140.13.0-1.el10_0
Fixed · RHSA-2026:53445
Red Hat Enterprise Linux 7 Extended Lifecycle Support
firefox-0:140.13.0-1.el7_9
Fixed · RHSA-2026:54248
Red Hat Enterprise Linux 8
firefox-0:140.13.0-1.el8_10
Fixed · RHSA-2026:47105
Red Hat Enterprise Linux 8
thunderbird-0:140.13.0-1.el8_10
Fixed · RHSA-2026:49922
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
firefox-0:140.13.0-1.el8_4
Fixed · RHSA-2026:54180
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
thunderbird-0:140.13.0-1.el8_4
Fixed · RHSA-2026:53455
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
firefox-0:140.13.0-1.el8_4
Fixed · RHSA-2026:54180
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
thunderbird-0:140.13.0-1.el8_4
Fixed · RHSA-2026:53455
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
firefox-0:140.13.0-1.el8_6
Fixed · RHSA-2026:54259
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
thunderbird-0:140.13.0-1.el8_6
Fixed · RHSA-2026:53453
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
firefox-0:140.13.0-1.el8_6
Fixed · RHSA-2026:54259
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
thunderbird-0:140.13.0-1.el8_6
Fixed · RHSA-2026:53453
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
firefox-0:140.13.0-1.el8_8
Fixed · RHSA-2026:54339
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
thunderbird-0:140.13.0-1.el8_8
Fixed · RHSA-2026:53454
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
firefox-0:140.13.0-1.el8_8
Fixed · RHSA-2026:54339
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
thunderbird-0:140.13.0-1.el8_8
Fixed · RHSA-2026:53454
Red Hat Enterprise Linux 9
firefox-0:140.13.0-1.el9_8
Fixed · RHSA-2026:47104
Red Hat Enterprise Linux 9
thunderbird-0:140.13.0-1.el9_8
Fixed · RHSA-2026:49921
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
firefox-0:140.13.0-1.el9_2
Fixed · RHSA-2026:54185
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
thunderbird-0:140.13.0-1.el9_2
Fixed · RHSA-2026:53475
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
firefox-0:140.13.0-1.el9_4
Fixed · RHSA-2026:54182
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
thunderbird-0:140.13.0-1.el9_4
Fixed · RHSA-2026:53444
Red Hat Enterprise Linux 9.6 Extended Update Support
firefox-0:140.13.0-1.el9_6
Fixed · RHSA-2026:54249
Red Hat Enterprise Linux 9.6 Extended Update Support
thunderbird-0:140.13.0-1.el9_6
Fixed · RHSA-2026:53446
Red Hat Enterprise Linux 10
rhel10/firefox-flatpak
Affected
Red Hat Enterprise Linux 10
rhel10/thunderbird-flatpak
Affected
Red Hat Enterprise Linux 6
firefox
Out of support scope
Red Hat Enterprise Linux 6
thunderbird
Out of support scope
Red Hat Enterprise Linux 7
thunderbird
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | firefox-0:140.13.0-1.el10_2 | Fixed | RHSA-2026:47101 |
| Red Hat Enterprise Linux 10 | thunderbird-0:140.13.0-1.el10_2 | Fixed | RHSA-2026:49621 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | firefox-0:140.13.0-1.el10_0 | Fixed | RHSA-2026:54181 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | thunderbird-0:140.13.0-1.el10_0 | Fixed | RHSA-2026:53445 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | firefox-0:140.13.0-1.el7_9 | Fixed | RHSA-2026:54248 |
| Red Hat Enterprise Linux 8 | firefox-0:140.13.0-1.el8_10 | Fixed | RHSA-2026:47105 |
| Red Hat Enterprise Linux 8 | thunderbird-0:140.13.0-1.el8_10 | Fixed | RHSA-2026:49922 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | firefox-0:140.13.0-1.el8_4 | Fixed | RHSA-2026:54180 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | thunderbird-0:140.13.0-1.el8_4 | Fixed | RHSA-2026:53455 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | firefox-0:140.13.0-1.el8_4 | Fixed | RHSA-2026:54180 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | thunderbird-0:140.13.0-1.el8_4 | Fixed | RHSA-2026:53455 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | firefox-0:140.13.0-1.el8_6 | Fixed | RHSA-2026:54259 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | thunderbird-0:140.13.0-1.el8_6 | Fixed | RHSA-2026:53453 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | firefox-0:140.13.0-1.el8_6 | Fixed | RHSA-2026:54259 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | thunderbird-0:140.13.0-1.el8_6 | Fixed | RHSA-2026:53453 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | firefox-0:140.13.0-1.el8_8 | Fixed | RHSA-2026:54339 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | thunderbird-0:140.13.0-1.el8_8 | Fixed | RHSA-2026:53454 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | firefox-0:140.13.0-1.el8_8 | Fixed | RHSA-2026:54339 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | thunderbird-0:140.13.0-1.el8_8 | Fixed | RHSA-2026:53454 |
| Red Hat Enterprise Linux 9 | firefox-0:140.13.0-1.el9_8 | Fixed | RHSA-2026:47104 |
| Red Hat Enterprise Linux 9 | thunderbird-0:140.13.0-1.el9_8 | Fixed | RHSA-2026:49921 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | firefox-0:140.13.0-1.el9_2 | Fixed | RHSA-2026:54185 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | thunderbird-0:140.13.0-1.el9_2 | Fixed | RHSA-2026:53475 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | firefox-0:140.13.0-1.el9_4 | Fixed | RHSA-2026:54182 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | thunderbird-0:140.13.0-1.el9_4 | Fixed | RHSA-2026:53444 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | firefox-0:140.13.0-1.el9_6 | Fixed | RHSA-2026:54249 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | thunderbird-0:140.13.0-1.el9_6 | Fixed | RHSA-2026:53446 |
| Red Hat Enterprise Linux 10 | rhel10/firefox-flatpak | Affected | n/a |
| Red Hat Enterprise Linux 10 | rhel10/thunderbird-flatpak | Affected | n/a |
| Red Hat Enterprise Linux 6 | firefox | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | thunderbird | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | thunderbird | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
References (13)
- https://access.redhat.com/security/cve/CVE-2026-16355 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=2052207 Permissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=2503439 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46203 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-16355
- https://www.cve.org/CVERecord?id=CVE-2026-16355
- https://www.mozilla.org/security/advisories/mfsa2026-68/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-69/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-70/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16355
- https://www.mozilla.org/security/advisories/mfsa2026-71/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-72/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16355
Change history (0)
No recorded changes yet.