{"uuid": "c795da3f-43a4-4e2c-84ee-d23ca95eb429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://gist.github.com/alon710/6a6c10a8f46d4e89fabacfe7e2463a97", "content": "# CVE-2026-10702: CVE-2026-10702: JIT Miscompilation Type Confusion in Mozilla SpiderMonkey\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-06-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-10702\n\n## Summary\nA type confusion vulnerability exists in the optimizing JIT compilation pipeline of Mozilla SpiderMonkey (Firefox) prior to version 151.0.3. An error in the JIT compiler's Range Analysis optimization pass allows the unsafe elimination of critical type guards. Under specific execution flows, an unauthenticated remote attacker can trigger a mismatch between predicted compile-time types and actual runtime types, resulting in memory corruption and arbitrary code execution within the browser's sandbox environment.\n\n## TL;DR\nA type confusion vulnerability in the Firefox SpiderMonkey JIT compiler allows remote code execution when an optimizing pass incorrectly removes critical type guards during range analysis.\n\n## Technical Details\n\n- **CWE ID**: CWE-843\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00553 (0.553% probability)\n- **Exploit Status**: None (No public exploits or PoC exist)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mozilla Firefox\n- NixOS (Firefox packages)\n- Ubuntu Linux (firefox-esr and firefox snap/deb packages)\n- Alpine Linux (firefox packages)\n- Wolfi / Chainguard (downstream node/browser engines using SpiderMonkey)\n- Homebrew (macOS environment packages)\n\n## Mitigation\n\n- Upgrade Mozilla Firefox to version 151.0.3 or higher.\n- Disable JIT compilation in environments where immediate patching is not possible.\n\n**Remediation Steps:**\n1. Determine all endpoints running Firefox versions older than 151.0.3.\n2. Apply updates via local package manager or enterprise-wide silent installers.\n3. For unpatched installations, configure 'javascript.options.ion' to false in about:config.\n\n## References\n\n- [https://bugzilla.mozilla.org/show_bug.cgi?id=2040903](https://bugzilla.mozilla.org/show_bug.cgi?id=2040903)\n- [https://www.mozilla.org/security/advisories/mfsa2026-54/](https://www.mozilla.org/security/advisories/mfsa2026-54/)\n- [https://access.redhat.com/security/cve/CVE-2026-10702](https://access.redhat.com/security/cve/CVE-2026-10702)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2484118](https://bugzilla.redhat.com/show_bug.cgi?id=2484118)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10702.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10702.json)\n- [https://www.wiz.io/vulnerability-database/cve/cve-2026-10702](https://www.wiz.io/vulnerability-database/cve/cve-2026-10702)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-10702) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T14:31:27.772753Z"}