{"id":"CVE-2026-8389","aliases":["EUVD-2026-29464","GHSA-qh6r-h4hf-pr8w","UBUNTU-CVE-2026-8389"],"status":"published","title":"JIT miscompilation in the JavaScript Engine: JIT component","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00422,"percentile":0.36804,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119","CWE-686","CWE-733","CWE-843"],"published":"2026-05-12T12:36:12Z","modified":"2026-10-26T18:10:00Z","exploits":[{"source":"pocgithub","id":"crixpwn/CVE-2026-8389","title":"crixpwn/CVE-2026-8389","date":"2026-06-04","url":"https://github.com/crixpwn/CVE-2026-8389"}],"affected":[{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0-0ubuntu0.22.04.1","102.12.0-0ubuntu0.22.04.1","102.13.0-0ubuntu0.22.04.1","102.15.1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.15.1-1","102.15.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["115.3.0-0ubuntu1","115.4.0-2","115.5.0-1","115.6.0-1","115.7.0-4","115.8.0-1","115.9.0-1","115.9.0-1build1","115.10.0-1"]}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2036983","tags":["Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-45/","tags":["Vendor Advisory"]},{"url":"https://github.com/crixpwn/CVE-2026-8389","tags":["exploit"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8389","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476466","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8389.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8389"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-45"},{"url":"https://github.com/advisories/GHSA-qh6r-h4hf-pr8w"},{"url":"https://ubuntu.com/security/CVE-2026-8389","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8389","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-45/#CVE-2026-8389","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-8389","title":"JIT miscompilation in the JavaScript Engine: JIT component","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.","status":"published","published":"2026-05-12T12:36:12.516Z","modified":"2026-07-15T02:48:11.989Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-686","CWE-843","CWE-119","CWE-733"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-29464","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.","status":"published","published":"2026-05-12T12:36:12Z","modified":"2026-07-15T02:48:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:53.678292Z"}],"ghsa":[{"id":"GHSA-qh6r-h4hf-pr8w","title":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in...","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.","status":"published","published":"2026-05-12T15:31:40Z","modified":"2026-06-30T03:37:46Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-119","CWE-733"],"updated_at":"2026-11-02T15:09:05.934873Z"}],"nvd":[{"id":"CVE-2026-8389","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.","status":"published","published":"2026-05-12T14:17:11.93Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-686","CWE-843","CWE-733"],"updated_at":"2026-11-02T14:12:18.613259Z"}],"osv":[{"id":"UBUNTU-CVE-2026-8389","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.","status":"published","published":"2026-05-12T14:17:00Z","modified":"2026-06-30T18:18:13.853103646Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"}]}}