Invalid Pointer Vulnerability in Firefox JavaScript Engine
CVE-2026-100813

8.8HIGH

Key Information:

Vendor

Mozilla
Status
Thunderbird
Firefox
Vendor
CVE Published:
29 September 2026

What is CVE-2026-100813?

This vulnerability pertains to an invalid pointer dereference issue within the JIT (Just-In-Time) component of the JavaScript Engine in Firefox. Attackers exploiting this flaw could potentially execute arbitrary code or cause a crash, impacting user safety and system security. Mozilla has addressed this vulnerability in Firefox version 157, and users are strongly encouraged to update to this version or later to mitigate potential risks. For further details, refer to Mozilla's advisory about this security flaw.

Affected Version(s)

Firefox 157

Thunderbird 157

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2068376
https://www.mozilla.org/security/advisories/mfsa2026-101/
https://www.mozilla.org/security/advisories/mfsa2026-97/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mozilla
.