CVE-2026-10702: CVE-2026-10702: JIT Miscompilation Type Confusion in Mozilla SpiderMonkey

#security #cve #cybersecurity

CVE-2026-10702: JIT Miscompilation Type Confusion in Mozilla SpiderMonkey

Vulnerability ID: CVE-2026-10702
CVSS Score: 4.3
Published: 2026-06-02

A type confusion vulnerability exists in the optimizing JIT compilation pipeline of Mozilla SpiderMonkey (Firefox) prior to version 151.0.3. An error in the JIT compiler's Range Analysis optimization pass allows the unsafe elimination of critical type guards. Under specific execution flows, an unauthenticated remote attacker can trigger a mismatch between predicted compile-time types and actual runtime types, resulting in memory corruption and arbitrary code execution within the browser's sandbox environment.

TL;DR

A type confusion vulnerability in the Firefox SpiderMonkey JIT compiler allows remote code execution when an optimizing pass incorrectly removes critical type guards during range analysis.

Technical Details

CWE ID: CWE-843
Attack Vector: Network (AV:N)
CVSS Base Score: 4.3 (Medium)
EPSS Score: 0.00553 (0.553% probability)
Exploit Status: None (No public exploits or PoC exist)
CISA KEV Status: Not Listed

Affected Systems

Mozilla Firefox
NixOS (Firefox packages)
Ubuntu Linux (firefox-esr and firefox snap/deb packages)
Alpine Linux (firefox packages)
Wolfi / Chainguard (downstream node/browser engines using SpiderMonkey)
Homebrew (macOS environment packages)

Mitigation Strategies

Upgrade Mozilla Firefox to version 151.0.3 or higher.
Disable JIT compilation in environments where immediate patching is not possible.

Remediation Steps:

Determine all endpoints running Firefox versions older than 151.0.3.
Apply updates via local package manager or enterprise-wide silent installers.
For unpatched installations, configure 'javascript.options.ion' to false in about:config.