RLSA-2026:5931 — Important: firefox security update

Summary

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

Release	Package	Fixed in
Rocky Linux · 10	firefox	0:140.9.0-1.el10_1

Vulnerabilities 37

Critical 10.0

CVE-2026-4689

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4691

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4696

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4700

Mitigation bypass in the Networking: HTTP component

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4701

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4702

JIT miscompilation in the JavaScript Engine component

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4705

Undefined behavior in the WebRTC: Signaling component

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4710

Incorrect boundary conditions in the Audio/Video component

Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4711

Use-after-free in the Widget: Cocoa component

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4717

Privilege escalation in the Netmonitor component

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4720

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4721

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4687

Sandbox escape due to incorrect boundary conditions in the Telemetry component

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4688

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4690

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4692 Public exploit

Sandbox escape in the Responsive Design Mode component

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.1

CVE-2026-4715

Uninitialized memory in the Graphics: Canvas2D component

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.1

CVE-2026-4716

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 8.8

CVE-2026-4698

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 8.1

CVE-2026-4718

Undefined behavior in the WebRTC: Signaling component

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4684

Race condition, use-after-free in the Graphics: WebRender component

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4685

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4686

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4693

Incorrect boundary conditions in the Audio/Video: Playback component

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4694

Incorrect boundary conditions, integer overflow in the Graphics component

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4695

Incorrect boundary conditions in the Audio/Video: Web Codecs component

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4697

Incorrect boundary conditions in the Audio/Video: Web Codecs component

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4699

Incorrect boundary conditions in the Layout: Text and Fonts component

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4704

Denial-of-service in the WebRTC: Signaling component

Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4706

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4707

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4708

Incorrect boundary conditions in the Graphics component

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4709

Incorrect boundary conditions in the Audio/Video: GMP component

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4712

Information disclosure in the Widget: Cocoa component

Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4713

Incorrect boundary conditions in the Graphics component

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4714

Incorrect boundary conditions in the Audio/Video component

Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4719

Incorrect boundary conditions in the Graphics: Text component

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2450733
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450741
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450744
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450752
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450747
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450738
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450710
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450755
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450725
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450739
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450726
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450714
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450727
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450723
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450724
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450734
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450748
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450757
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450730
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450713
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450711
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450719
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450729
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450722
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450720
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450712
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450718
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450751
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450735
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450721
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450715
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450732
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450742
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450746
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450756
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450740
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450728