Back Cybersecuritynews

Single-Character Typo of “&” Instead of “|” Leads to 0

Cybersecuritynews •Guru Baran • February 18, 2026

A critical Remote Code Execution (RCE) vulnerability in Mozilla Firefox was caused by a single-character typo in the SpiderMonkey JavaScript engine’s WebAssembly garbage collection code, where a developer mistakenly typed “&” (bitwise AND) instead of “|” (bitwise OR). Security researcher Erge discovered the flaw while examining the Firefox 149 Nightly source code for inspiration for […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Single-Character Typo Causes 0-Day RCE Vulnerability in Firefox A critical Remote Code Execution (RCE) vulnerability in Mozilla Firefox was identified due to a single-character typo in the SpiderMonkey JavaScript engine’s WebAssembly garbage collection code. The error occurred when a developer mistakenly typed '&' instead of '|', leading to the flaw's discovery by security researcher Erge while reviewing the Firefox 149 Nightly source code. 4 sources 64

Single-Character Typo of “&” Instead of “|” Leads to 0

The full story

Extracted Entities

Attack Types (1)

Platforms (1)