CVE-2026-109721

CVE-2026-109721 is an incorrect boundary-condition bug in the JavaScript engine’s JIT compiler used by Mozilla Firefox and Thunderbird. It is triggered when the engine JIT-compiles and runs JavaScript that hits the faulty bounds check, which can corrupt memory inside the browser or mail client process. A remote attacker who can supply that script—typically via a malicious web page, or via scripted content handled by Thunderbird—may be able to crash the application or run code with the user’s privileges. Anyone still on Firefox before 158, Firefox ESR before 153.5, Thunderbird before 158, or Thunderbird before 153.5 is affected. A public proof-of-concept reference exists; the issue is not listed in CISA KEV, CVSS is not yet scored, and the 30-day exploitation probability is low (EPSS 0.2%).

What to do: Update Firefox to 158 or later and Firefox ESR to 153.5 or later, and update Thunderbird to 158 or 153.5 or later. Until those builds are installed, treat untrusted web content and HTML email as higher risk and prefer a current browser for general browsing.