RLSA-2026:0667 — Important: firefox security update

Summary

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)

* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878)

* firefox: Use-after-free in the IPC component (CVE-2026-0882)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)

* firefox: Information disclosure in the Networking component (CVE-2026-0883)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)

* firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)

* firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)

* firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)

* firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

Release	Package	Fixed in
Rocky Linux · 8	firefox	0:140.7.0-1.el8_10

Vulnerabilities 13

Critical 9.8

CVE-2026-0879

Sandbox escape due to incorrect boundary conditions in the Graphics component

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
Critical 9.8

CVE-2026-0884

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
High 8.8

CVE-2026-0880

Sandbox escape due to integer overflow in the Graphics component

Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
High 8.8

CVE-2026-0882

Use-after-free in the IPC component

Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
High 8.1

CVE-2026-0877

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
High 8.1

CVE-2026-0891

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
High 8.0

CVE-2026-0878

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
High 7.5

CVE-2025-14327

Spoofing issue in the Downloads Panel component

Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Dec 9, 2025
Medium 6.5

CVE-2026-0885

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
Medium 5.4

CVE-2026-0890

Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
Medium 5.3

CVE-2026-0883

Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
Medium 5.3

CVE-2026-0886

Incorrect boundary conditions in the Graphics component

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026
Medium 4.3

CVE-2026-0887

Clickjacking issue, information disclosure in the PDF Viewer component

Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jan 13, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2420507
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428961
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428963
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428965
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428966
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428967
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428968
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428969
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428971
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428972
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428973
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428975
report
https://bugzilla.redhat.com/show_bug.cgi?id=2428978