CVE-2026-4702
Published: 24 March 2026
Summary
CVE-2026-4702 is a critical-severity Type Confusion (CWE-843) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 37.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4702 is a JIT miscompilation vulnerability in the JavaScript Engine component of Mozilla products. It affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird versions prior to 140.9. The vulnerability, published on 2026-03-24, is classified under CWE-843 and carries a CVSS v3.1 base score of 9.8.
The vulnerability can be exploited by a remote attacker with network access, requiring low attack complexity, no privileges, and no user interaction. Exploitation results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) with no change in scope.
Mozilla security advisories, including MFSA2026-20, MFSA2026-22, MFSA2026-23, and MFSA2026-24, along with Bugzilla entry 2013560, confirm the issue was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Security practitioners should prioritize updating affected products to these versions or later to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14821
Vulnerability details
JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote JIT miscompilation RCE in browser JS engine with no privileges/user interaction directly enables drive-by compromise (T1189) and client application exploitation for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring timely remediation of the JIT miscompilation flaw through installation of patches released in Firefox 149, ESR 140.9, and Thunderbird equivalents.
Enables scanning and monitoring to identify systems running vulnerable versions of Firefox or Thunderbird affected by the JavaScript Engine miscompilation.
Ensures receipt and dissemination of Mozilla security advisories like MFSA2026-20, facilitating awareness and prompt patching of the vulnerability.