CVE-2026-4698: Critical JIT Miscompilation in Firefox

CVE-2026-4698 is a JIT miscompilation in the JavaScript engine's JIT component in Firefox. The NVD record scores it CVSS 9.8 (critical), while Mozilla rates it High. Mozilla fixed it in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149 and Thunderbird 140.9. Update to those versions or later, and check bundled copies too.

What's affected

The NVD record lists Mozilla Firefox as affected, and the description says the vulnerability was fixed in the following releases:

• Firefox 149
• Firefox ESR 115.34
• Firefox ESR 140.9
• Thunderbird 149
• Thunderbird 140.9

Mozilla's advisory for Firefox 149 is the source of the severity rating. The vector in the NVD record reads CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How to check if you're exposed

1. Find your version. In Firefox open the menu, choose Help, then About Firefox. For Thunderbird use Help, then About Thunderbird.
2. From a terminal, run firefox --version or thunderbird --version. On macOS the binary sits inside the app bundle, for example /Applications/Firefox.app/Contents/MacOS/firefox --version.
3. On Debian or Ubuntu, apt list --installed 2>/dev/null | grep -i -E 'firefox|thunderbird' shows what the package manager installed. On Fedora or RHEL, use rpm -q firefox thunderbird.
4. Compare the result with the fixed versions above. Anything older on the same branch is exposed to CVE-2026-4698.

Bundled copies are easy to miss. Kiosk images, test runners with a pinned Firefox, and container images can carry old builds, and a scan of the image catches those.

What to do now

1. Update Firefox and Thunderbird on every managed device to the fixed version for the branch you run.
2. Restart the browser after the update. Mozilla's updater only protects you once the new build is running.
3. Update images and CI runners that pin a Firefox version, such as browser test containers.
4. Where you cannot update today, limit who can browse untrusted sites from the affected machine and plan the update for the next change window.
5. Record the new version in your inventory so the next review takes minutes.

Why it matters

The record maps this to CWE-733 and CWE-843, which covers compiler optimization removing or modifying security checks, which is how a JIT miscompilation can undo a safety check, and type confusion, where code treats a value as a different type than it really is. The affected component is JavaScript Engine: JIT. Mozilla's advisory lists the entry as high impact and gives no further technical detail, which is normal while most users are still updating.

JIT compilers translate hot JavaScript into machine code on the fly. If the generated code does not match what the script means, memory safety checks can quietly stop applying to it. Mozilla fixed the bug in the same release as the other engine bugs, so one update closes them together. The record's KEV flag is false and the advisory does not report exploitation.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Mozilla Foundation Security Advisory 2026-20 (Firefox 149)
• Mozilla Foundation Security Advisory 2026-22 (Firefox ESR 140.9)
• Gold page for this CVE

Last reviewed: 19 October 2026.