- CVE-2026-2770: keep construction depth for custom elements in sync; wrap AutoConstructionDepth in mozilla::Maybe so early throws in HTMLConstructor still tear it down deterministically (Bug 2014585) - CVE-2026-2763: use-after-free in SuppressDeletedProperty during property iteration; replace GetPrototype + GetPropertyDescriptor (both CanGC/re-entrant) with staticPrototype() + LookupPropertyPure() + GetPropertyAttributes() in js/src/vm/Iteration.cpp (Bug 2012018) - CVE-2026-2764: JIT baseline CacheIR call-scripted stub could observe a not-yet-created `this` if it OOM'd between reservation and construction; create `this` after pushing arguments and thread the argument through pushArguments/CreateThis paths (Bug 2012608)