Red Hat Security Advisory: firefox security, bug fix, and enhancement update

Fixed packages 3

Vulnerabilities 29

• Critical 9.6
  CVE-2026-109705

  Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

  Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Critical 9.6
  CVE-2026-109707

  Sandbox escape due to use-after-free in the Networking component

  Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Critical 9.6
  CVE-2026-109708

  Sandbox escape due to incorrect boundary conditions in the Networking component

  Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Critical 9.6
  CVE-2026-109740

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.8
  CVE-2026-109704

  Privilege escalation in the Application Update component

  Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.8
  CVE-2026-109709

  Information disclosure, privilege escalation in the Security: Process Sandboxing component

  Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.8
  CVE-2026-109730

  Integer overflow in the Graphics component

  Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.2
  CVE-2026-77214

  libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer

  libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, …

  libexpat project libexpat insighttoolkit4 cmake Debian Ubuntu Azure Linux Alpine
  Oct 7, 2026
• High 8.1
  CVE-2026-109715 Public exploit

  Incorrect boundary conditions in the JavaScript Engine component

  Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.1
  CVE-2026-109716

  Incorrect boundary conditions in the JavaScript Engine component

  Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.1
  CVE-2026-109722 Public exploit

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 7.1
  CVE-2026-109712

  Sandbox escape due to uninitialized memory in the Graphics component

  Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 7.1
  CVE-2026-109720

  JIT miscompilation in the JavaScript: WebAssembly component

  JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109706

  Use-after-free in the Storage: IndexedDB component

  Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109711

  Use-after-free in the Graphics: Canvas2D component

  Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109713

  Use-after-free in the Crash Reporting component

  Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109717

  Use-after-free in the DOM: Bindings (WebIDL) component

  Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109718

  Use-after-free in the XML component

  Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109721 Public exploit

  Incorrect boundary conditions in the JavaScript Engine: JIT component

  Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109723

  Integer overflow in the Layout: Text and Fonts component

  Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109724

  Use-after-free in the DOM: Core & HTML component

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109725

  Use-after-free in the DOM: Core & HTML component

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109726

  Use-after-free in the SVG component

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109727

  Use-after-free in the Audio/Video component

  Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109728

  Use-after-free in the DOM: Animation component

  Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109729

  Use-after-free in the JavaScript Engine: JIT component

  Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 5.4
  CVE-2026-109732

  Use-after-free in the DOM: Streams component

  Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Medium 4.2
  CVE-2026-109719

  Race condition, use-after-free in the Graphics: CanvasWebGL component

  Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• Low 2.9
  CVE-2026-45186

  In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service vi…

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  May 10, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468575
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550404
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550405
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550408
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550413
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550420
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550424
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550426
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550438
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550442
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550446
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550450
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550467
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550469
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550474
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550478
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89758.json
• report
  https://access.redhat.com/security/cve/CVE-2026-45186
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45186
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45186
• article
  https://github.com/libexpat/libexpat/pull/1216
• report
  https://access.redhat.com/security/cve/CVE-2026-77214
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-77214
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-77214
• article
  https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0