SB2026051267 - Multiple vulnerabilities in Mozilla Firefox

Description

This security bulletin contains information about 4 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-8388)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the JavaScript Engine: JIT component when processing crafted JavaScript. A remote attacker can supply specially crafted script content to execute arbitrary code.

2) Incorrect calculation (CVE-ID: CVE-2026-8389)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to JIT miscompilation in the JavaScript Engine: JIT component when processing crafted JavaScript. A remote attacker can supply specially crafted script content to execute arbitrary code.

3) Use-after-free (CVE-ID: CVE-2026-8390)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the JavaScript: WebAssembly component when processing crafted WebAssembly content. A remote attacker can supply specially crafted WebAssembly content to execute arbitrary code.

4) Input validation error (CVE-ID: CVE-2026-8391)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an unspecified issue in the JavaScript Engine component. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-45/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2036978
• https://bugzilla.mozilla.org/show_bug.cgi?id=2036983
• https://bugzilla.mozilla.org/show_bug.cgi?id=2038081
• https://bugzilla.mozilla.org/show_bug.cgi?id=2038575