CVE-2026-8389Patch(mozilla / firefox)

MEDIUMCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch mozilla firefox systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

mozilla CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.mozilla.org/security/advisories/mfsa2026-45/

Other references

Weakness type (CWE)

CWE-119CWE-686CWE-843CWE-733

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

firefox

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 3d ago at 1 mentions (2026-05-12); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

mozilla

Products

firefox

Deep dive

Activity timeline4 mentions / 4d

Signal classification3 categories

Patch

250.0%

Disclosure

125.0%

PoC

125.0%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-12	1	Patch1
2026-05-13	1	Patch1
2026-05-15	1	Disclosure1
2026-06-04	1	PoC1

Full discourse4 posts

crixer@pwning_me128d
PoC
https://github.com/crixpwn/CVE-2026-8389 It has been a month since the patch was released, so I am releasing this. enjoy it
Post summary
The author shares a GitHub repository for CVE‑2026‑8389 after the vendor patch was released a month earlier, indicating a proof‑of‑concept or exploit script is being released.
034019513919.8K
499 followersView on X
xvonfers@xvonfers150d
Patch
(CVE-2026-8388)[2036978]Incorrect boundary conditions in JIT https://hg-edge.mozilla.org/mozilla-central/rev/f5e01e65b75a28326c9cb3c858f803b2fb6d828a (CVE-2026-8389)[2036983]JIT miscompilation https://hg-edge.mozilla.org/mozilla-central/rev/f40113af5ca58bb949fe7c19f58b82ff1723b343 (CVE-2026-8401)[2038679]SBX escape in the Profile Backup https://hg-edge.mozilla.org/mozilla-central/rev/ef49b255ce2a13b89743a1daf85526323a5d38ee https://www.mozilla.org/en-US/security/advisories/mfsa2026-45/ Reported by @ggwhyp
Post summary
The post lists three newly disclosed Mozilla CVEs with concise technical descriptions, links to the corresponding patch commits, and references a Mozilla security advisory where the patches are formally announced.
0201581.7K
5.0K followersView on X
Ferramentas Linux@Cezar_H_Linux148d
Disclosure
Stop chasing the patch. Start dissecting the malware. 🔥 A new Firefox JIT flaw (CVE-2026-8389) can pwn your browser in one click. Read more -> https://tinyurl.com/4puedmxu #Security https://t.co/DoR1nMsDSU
Post summary
The tweet announces a new Firefox JIT vulnerability (CVE-2026-8389) and urges readers to understand the malware, but it provides no technical details, exploit code, or evidence of active exploitation.
1000188
1.5K followersView on X
White Rabbitx 🏴‍☠️@TheRabbitPy151d
Patch
🧨 Firefox 150.0.3 is a critical patch. Here's an overview: CVE‑2026‑8401 – sandbox escape in Profile Backup CVE‑2026‑8391 – priv‑esca‑like “other” JS engine bug CVE‑2026‑8390 – UAF in JS:WebAssembly CVE‑2026‑8389 – JIT miscompilation in JS JIT CVE‑2026‑8388 – wrong boundary checks in JS JIT Any one of these can pop your browser; together they’re a browser‑pwn trifecta. #Firefox #CVE‑2026‑8401 #CVE‑2026‑8391 #CVE‑2026‑8390 #CVE‑2026‑8389 #CVE‑2026‑8388 #BrowserSecurity #JIT #WebAssembly #JavaScript #DevSecOps https://nvd.nist.gov/vuln/detail/CVE-2026-8401 https://nvd.nist.gov/vuln/detail/CVE-2026-8391 https://nvd.nist.gov/vuln/detail/CVE-2026-8390 https://nvd.nist.gov/vuln/detail/CVE-2026-8389 https://nvd.nist.gov/vuln/detail/CVE-2026-8388
Post summary
The tweet announces that Firefox 150.0.3 patches five critical vulnerabilities, providing brief technical details but no proof of concept, exploit code, or evidence of active exploitation.
0001082
1.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mozilla	firefox	-	-	-

Explore more

Back to dashboard mozilla CVEs firefox vulnerabilities

What researchers are saying

CVE-2026-8389

White Rabbitx 🏴‍☠️[verified]@TheRabbitPyPatch

The tweet announces that Firefox 150.0.3 patches five critical vulnerabilities, providing brief technical details but no proof of concept, exploit code, or evidence of active exploitation.

crixer@pwning_mePoC

The author shares a GitHub repository for CVE‑2026‑8389 after the vendor patch was released a month earlier, indicating a proof‑of‑concept or exploit script is being released.

xvonfers@xvonfersPatch

The post lists three newly disclosed Mozilla CVEs with concise technical descriptions, links to the corresponding patch commits, and references a Mozilla security advisory where the patches are formally announced.

Ferramentas Linux@Cezar_H_LinuxDisclosure

The tweet announces a new Firefox JIT vulnerability (CVE-2026-8389) and urges readers to understand the malware, but it provides no technical details, exploit code, or evidence of active exploitation.