Skip to content
OpenAdvisories
Critical RHSA-2026:92012 43 CVEs

Red Hat Security Advisory: firefox security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream firefox 0:140.17.0-1.el9_4
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream firefox-debuginfo 0:140.17.0-1.el9_4
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream firefox-debugsource 0:140.17.0-1.el9_4
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream firefox-x11 0:140.17.0-1.el9_4

Vulnerabilities 43

  • Critical 9.8
    CVE-2026-100788

    Invalid pointer in the JavaScript: WebAssembly component

    Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100758

    Sandbox escape in the DOM: Navigation component

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100762

    Sandbox escape due to use-after-free in the DOM: Content Processes component

    Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100770

    Sandbox escape due to use-after-free in the DOM: Content Processes component

    Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100775

    Sandbox escape in the Graphics component

    Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100778

    Sandbox escape due to use-after-free in the DOM: Core & HTML component

    Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100781

    Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

    Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100786

    Sandbox escape due to use-after-free in the Graphics component

    Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100794

    Sandbox escape due to incorrect boundary conditions in the Internationalization component

    Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100811

    Sandbox escape due to use-after-free in the DOM: Core & HTML component

    Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100818

    Sandbox escape due to use-after-free in the Widget: Gtk component

    Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-100819

    Sandbox escape due to incorrect boundary conditions in the XPCOM component

    Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.6
    CVE-2026-92035

    Sandbox escape due to incorrect boundary conditions in the Graphics component

    Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100757

    Use-after-free in the Widget component

    Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100767

    Use-after-free in the Networking: Cache component

    Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100769

    Use-after-free in the JavaScript: WebAssembly component

    Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100772

    Use-after-free in the DOM: Core & HTML component

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100773

    Use-after-free in the Storage: IndexedDB component

    Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100774

    Use-after-free in the DOM: Core & HTML component

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100776

    Use-after-free in the JavaScript: WebAssembly component

    Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100777

    Use-after-free in the Graphics: Canvas2D component

    Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100779

    Use-after-free in the XSLT component

    Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100780

    Use-after-free in the DOM: Core & HTML component

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100782

    Privilege escalation due to incorrect boundary conditions in the Graphics component

    Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100784

    Use-after-free in the Layout: Text and Fonts component

    Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100785

    Use-after-free in the DOM: Core & HTML component

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100789

    Use-after-free in the Graphics: Canvas2D component

    Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100790

    Use-after-free in the XSLT component

    Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100791

    Use-after-free in the DOM: Core & HTML component

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100797

    Privilege escalation due to use-after-free in the Graphics: WebRender component

    Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100801

    Privilege escalation in the DLL Services component

    Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100807

    Privilege escalation in the DOM: Service Workers component

    Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100820

    Privilege escalation in the Address Bar component

    Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-100832

    Use-after-free in the Graphics: Canvas2D component

    Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian
  • High 8.1
    CVE-2026-100756

    Incorrect boundary conditions in the Audio/Video: Playback component

    Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.1
    CVE-2026-100759

    Uninitialized memory in the Storage: Quota Manager component

    Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.1
    CVE-2026-100771

    Undefined behavior in the DOM: Streams component

    Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.1
    CVE-2026-100803

    Same-origin policy bypass in the WebExtensions component

    Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 7.1
    CVE-2026-100792

    JIT miscompilation in the JavaScript: WebAssembly component

    JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.7
    CVE-2026-100821

    Site isolation issue in the Panning and Zooming component

    Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-100766

    Information disclosure in the Networking: JAR component

    Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-100783

    Uninitialized memory in the Audio/Video component

    Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-96869

    Information disclosure in the Networking component

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533789
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543113
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543114
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543116
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543120
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543121
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543123
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543125
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543128
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543130
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543131
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543133
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543134
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543137
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543140
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543142
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543144
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543145
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543146
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543149
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543150
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543155
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543156
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543157
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543159
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543160
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543161
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543163
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543164
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543167
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543172
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543174
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543177
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543182
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543183