PatchGap
Firefox · SpiderMonkey

CVE-2026-4721

Memory Corruption in SpiderMonkey
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentSpiderMonkey
Bug ClassMemory Corruption
Tracker2013762
Fix commita9cf72f7cea9 (firefox) +0/-1
CISA KEVNot listed
CreditedChristian Holler, Timothy Nikkel, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-03-24

Files Changed

  • js/src/jit/MIR-wasm.h

Patch

view commit
diff --git a/js/src/jit/MIR-wasm.h b/js/src/jit/MIR-wasm.h
index 5384977e567..2e16b759b25 100644
--- a/js/src/jit/MIR-wasm.h
+++ b/js/src/jit/MIR-wasm.h
@@ -1358,7 +1358,6 @@ class MWasmLoadTableElement : public MBinaryInstruction,
                         wasm::RefType refType)
       : MBinaryInstruction(classOpcode, elements, index) {
     setResultType(MIRType::WasmAnyRef);
-    setMovable();
     setWasmRefType(wasm::MaybeRefType(refType));
   }
Loading diff…
On This Page