CVE-2026-8388 involves incorrect boundary conditions in the Just-In-Time (JIT) component of the JavaScript Engine in Mozilla Firefox. This vulnerability relates to memory safety issues categorized under CWE-119 and CWE-787. It affects Firefox versions prior to 150.0.3 and Firefox ESR versions prior to 115.36 and 140.11. The flaw was addressed by Mozilla in the security advisories MFSA2026-45 and MFSA2026-47, which indicate that the issue could lead to memory corruption and potentially arbitrary code execution. The CVSS v3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity but not availability. There are no known exploits in the wild at this time.

The vulnerability could allow an attacker to cause memory corruption due to incorrect boundary checks in the JavaScript Engine's JIT component. This may lead to partial compromise of confidentiality and integrity of the affected system. However, there is no evidence of active exploitation in the wild. The impact is rated medium based on the CVSS score of 6.5.

Mozilla has released official fixes for this vulnerability in Firefox 150.0.3, Firefox ESR 115.36, and Firefox ESR 140.11. Users and administrators should upgrade to these versions or later to remediate the issue. There is no indication that additional mitigation steps are required beyond applying the official updates.