ALSA-2026:10767 — Important: firefox security update

Summary

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)
* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)
* firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)
* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)
* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)
* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)
* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)
* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)
* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)
* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)
* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)
* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)
* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)
* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)
* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)
* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)
* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)
* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)
* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)
* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)
* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)
* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)
* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

Release	Package	Fixed in
AlmaLinux · 10	firefox	140.10.0-1.el10_1

Vulnerabilities 25

Critical 9.8

CVE-2026-6748

Uninitialized memory in the Audio/Video: Web Codecs component

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Critical 9.8

CVE-2026-6771

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 8.8

CVE-2026-6750

Privilege escalation in the Graphics: WebRender component

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 8.8

CVE-2026-6761

Privilege escalation in the Networking component

Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 8.8

CVE-2026-6769

Privilege escalation in the Debugger component

Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.8

CVE-2026-6776

Incorrect boundary conditions in the WebRTC: Networking component

Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6746

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6747

Use-after-free in the WebRTC component

Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6749

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6754

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6759

Use-after-free in the Widget: Cocoa component

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6766

Incorrect boundary conditions in the Libraries component in NSS

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6772

Incorrect boundary conditions in the Libraries component in NSS

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6785

Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.5

CVE-2026-6786

Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.3

CVE-2026-6751

Uninitialized memory in the Audio/Video: Web Codecs component

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.3

CVE-2026-6752

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
High 7.3

CVE-2026-6753

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.5

CVE-2026-6763

Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.5

CVE-2026-6764

Incorrect boundary conditions in the DOM: Device Interfaces component

Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.5

CVE-2026-6770 Public exploit

Other issue in the Storage: IndexedDB component

Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.3

CVE-2026-6757

Invalid pointer in the JavaScript: WebAssembly component

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 6.3

CVE-2026-6762

Spoofing issue in the DOM: Core & HTML component

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 5.3

CVE-2026-6765 Public exploit

Information disclosure in the Form Autofill component

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026
Medium 5.3

CVE-2026-6767

Other issue in the Libraries component in NSS

Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Apr 21, 2026

References

report
https://access.redhat.com/security/cve/CVE-2026-6746
report
https://access.redhat.com/security/cve/CVE-2026-6747
report
https://access.redhat.com/security/cve/CVE-2026-6748
report
https://access.redhat.com/security/cve/CVE-2026-6749
report
https://access.redhat.com/security/cve/CVE-2026-6750
report
https://access.redhat.com/security/cve/CVE-2026-6751
report
https://access.redhat.com/security/cve/CVE-2026-6752
report
https://access.redhat.com/security/cve/CVE-2026-6753
report
https://access.redhat.com/security/cve/CVE-2026-6754
report
https://access.redhat.com/security/cve/CVE-2026-6757
report
https://access.redhat.com/security/cve/CVE-2026-6759
report
https://access.redhat.com/security/cve/CVE-2026-6761
report
https://access.redhat.com/security/cve/CVE-2026-6762
report
https://access.redhat.com/security/cve/CVE-2026-6763
report
https://access.redhat.com/security/cve/CVE-2026-6764
report
https://access.redhat.com/security/cve/CVE-2026-6765
report
https://access.redhat.com/security/cve/CVE-2026-6766
report
https://access.redhat.com/security/cve/CVE-2026-6767
report
https://access.redhat.com/security/cve/CVE-2026-6769
report
https://access.redhat.com/security/cve/CVE-2026-6770
report
https://access.redhat.com/security/cve/CVE-2026-6771
report
https://access.redhat.com/security/cve/CVE-2026-6772
report
https://access.redhat.com/security/cve/CVE-2026-6776
report
https://access.redhat.com/security/cve/CVE-2026-6785
report
https://access.redhat.com/security/cve/CVE-2026-6786
report
https://bugzilla.redhat.com/2460074
report
https://bugzilla.redhat.com/2460075
report
https://bugzilla.redhat.com/2460076
report
https://bugzilla.redhat.com/2460078
report
https://bugzilla.redhat.com/2460079
report
https://bugzilla.redhat.com/2460085
report
https://bugzilla.redhat.com/2460086
report
https://bugzilla.redhat.com/2460088
report
https://bugzilla.redhat.com/2460092
report
https://bugzilla.redhat.com/2460094
report
https://bugzilla.redhat.com/2460095
report
https://bugzilla.redhat.com/2460096
report
https://bugzilla.redhat.com/2460097
report
https://bugzilla.redhat.com/2460099