CVE-2026-4698 is a critical security vulnerability caused by a just-in-time (JIT) compilation miscompilation issue in the JavaScript engine component of Mozilla Firefox. The flaw could allow an attacker to compromise system confidentiality, integrity, and availability. Mozilla fixed this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability is part of a broader set of memory safety and boundary condition bugs addressed simultaneously. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of CVE-2026-4698 could result in complete compromise of the affected Firefox or Thunderbird application, including arbitrary code execution, data corruption, or denial of service. The vulnerability affects the JavaScript engine's JIT compiler, which is critical for performance and security. Given the critical CVSS score and impact metrics, this vulnerability poses a high risk to users running vulnerable versions prior to the fixed releases.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to fully remediate the issue. No additional mitigation steps are required beyond applying these official updates. Patch status is confirmed by Mozilla advisories linked in the vendor advisory URLs.