CVE-2026-8389 - Vulnerability Details - OpenCVE

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Mozilla	Firefox

Configuration 1 [-]

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2036983
https://www.mozilla.org/security/advisories/mfsa2026-45/

History

Wed, 13 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787

Wed, 13 May 2026 17:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::*

Wed, 13 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-686 CWE-843
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 12 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Tue, 12 May 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 12 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
Title		JIT miscompilation in the JavaScript Engine: JIT component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2036983 https://www.mozilla.org/security/advisories/mfsa2026-45/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-05-12T12:36:12.516Z

Updated: 2026-05-13T15:50:14.332Z

Reserved: 2026-05-12T12:36:11.734Z

Link: CVE-2026-8389

Vulnrichment

Updated: 2026-05-13T15:50:01.567Z

NVD

Status : Analyzed

Published: 2026-05-12T14:17:11.930

Modified: 2026-05-13T17:23:05.003

Link: CVE-2026-8389

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8389", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-05-12T12:36:11.734Z", "datePublished": "2026-05-12T12:36:12.516Z", "dateUpdated": "2026-05-13T15:50:14.332Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "150.0.3", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3."}]}], "title": "JIT miscompilation in the JavaScript Engine: JIT component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2036983"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-45/"}], "credits": [{"lang": "en", "value": "ggwhyp"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-05-12T12:36:12.516Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-686", "lang": "en", "description": "CWE-686 Function Call With Incorrect Argument Type"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-843", "lang": "en", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T15:50:10.685842Z", "id": "CVE-2026-8389", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:50:14.332Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8389", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:50:10.685842Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-686", "description": "CWE-686 Function Call With Incorrect Argument Type"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:50:01.567Z"}}], "cna": {"title": "JIT miscompilation in the JavaScript Engine: JIT component", "credits": [{"lang": "en", "value": "ggwhyp"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "150.0.3", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2036983"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-45/"}], "descriptions": [{"lang": "en", "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.", "supportingMedia": [{"type": "text/html", "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-05-12T12:36:12.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8389", "state": "PUBLISHED", "dateUpdated": "2026-05-13T15:50:14.332Z", "dateReserved": "2026-05-12T12:36:11.734Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2026-05-12T12:36:12.516Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}