CVE-2026-100793

Think of the browser's JavaScript engine as a translator that turns web code into instructions the computer understands. This bug lets a malicious website or crafted email attachment make the translator get confused and reveal information it shouldn't — like someone slipping a fake note into a stack of papers and getting back confidential details by mistake. It only works if you actually open or visit the bad content.

This matters to you if your business uses Thunderbird for email or Firefox for web browsing on any computer. It affects all these installs running a version older than 157, and the risk only becomes real if someone on your team opens a malicious email attachment or visits a crafted website.

A single click on a malicious link or malicious email attachment is enough to trigger this flaw, since no login or special access is needed by the attacker — only a moment of user interaction. While there's no confirmed case yet of this specific bug being exploited in the wild, the low effort required to trigger it and the sensitive data at stake mean you should not wait to patch. Treat this as an urgent update, not a routine one.

1. Inventory all endpoints running Thunderbird or Firefox and identify installed versions. 2. Any version prior to 157 is vulnerable; target version 157 or later for both Thunderbird and Firefox — there is no separate workaround, as the fix is in the JIT compiler itself. 3. Deploy the update via your standard patch management or enable auto-update where available; no configuration change can mitigate this short of disabling JIT (not practical for most users). 4. There is no CISA KEV deadline since this is not currently listed in KEV. 5. Monitor vendor advisories and your EDR/browser telemetry for any crash reports or anomalous JS engine behavior post-patch, and watch for updated exploitation reporting given the rising press attention tied to the ShinyHunters actor.

CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a confidentiality-only impact requiring user interaction, consistent with a type-confusion (CWE-843) JIT miscompilation in the JavaScript engine. EPSS predicts low near-term exploitation likelihood (19th percentile, flat trend) and no exploit code or KEV listing exists yet, but press attention is rising with an actor reference (ShinyHunters) in roundup coverage — this is attention, not confirmed exploitation. Exploit maturity is currently theoretical/PoC-less; fixed in Thunderbird 157 and Firefox 157.