CVE-2026-100793 — Thunderbird — Fixed in 157; Firefox — Fixed in 157

Medium6.5 Published on Sep 29, 2026

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Fixed versions

Choose the version for your installed product and release branch.

Product	Fixed versions
Thunderbird	157
Firefox	157

CVSS score6.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-843

FortiMail path traversal and NetScaler SAML flaw under active exploit join CISA KEV, forcing urgent patching plus PHP, PaperCut and Spectre fixes.

This product uses the NVD API but is not endorsed or certified by the NVD.