Skip to content
OpenAdvisories
High ALAS2023-2026-3281 62 CVEs

Important: firefox security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-109783: Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5. CVE-2026-109782: Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5. CVE-2026-109781: Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109778: Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109777: Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109776: Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109775: Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109770: Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109767: Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109766: Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109764: Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109763: Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109762: Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109760: Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109759: Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109757: Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109756: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109753: Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109752: Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109751: Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109744: Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109743: Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109742: Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109741: Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109738: Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109737: Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109736: Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109734: Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109732: Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109730: Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109728: Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109727: Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109726: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109725: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. CVE-2026-109724: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. CVE-202

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 firefox 0:153.5.0-1.amzn2023.0.1
Amazon Linux · 2023 firefox-debuginfo 0:153.5.0-1.amzn2023.0.1
Amazon Linux · 2023 firefox-debugsource 0:153.5.0-1.amzn2023.0.1

Vulnerabilities 62

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-100766.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-100787.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109704.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109705.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109706.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109707.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109708.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109709.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109710.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109711.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109712.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109713.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109715.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109716.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109717.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109718.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109719.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109720.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109721.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109722.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109723.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109724.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109725.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109726.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109727.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109728.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109729.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109730.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109731.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109732.html