High WID-SEC-2026-3654 78 CVEs

Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

Published Sep 29, 2026 · Updated Nov 12, 2026 · Revision 24 · de

Vendor: amazon Vendor: Debian Vendor: IGEL Vendor: Mozilla Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Product: Enterprise Linux Product: Firefox Product: Firefox ESR Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: OS Product: Rocky Linux Product: Thunderbird Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox ESR, Mozilla Firefox und Thunderbird ausnutzen, um beliebigen Programmcode auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe zu starten.

Product

Firefox ist ein Open Source Web Browser.
ESR ist die Variante mit verlängertem Support.

Vulnerabilities 78

Critical 9.8

CVE-2026-100788

Invalid pointer in the JavaScript: WebAssembly component

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.8

CVE-2026-100810

Other issue in the DevTools component

Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100758

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100760

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100762

Sandbox escape due to use-after-free in the DOM: Content Processes component

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100770

Sandbox escape due to use-after-free in the DOM: Content Processes component

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100775

Sandbox escape in the Graphics component

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100778

Sandbox escape due to use-after-free in the DOM: Core & HTML component

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100781

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100786

Sandbox escape due to use-after-free in the Graphics component

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100787

Sandbox escape in the XUL component

Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100794

Sandbox escape due to incorrect boundary conditions in the Internationalization component

Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100800

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100804

Sandbox escape due to use-after-free in the Preferences: Backend component

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100811

Sandbox escape due to use-after-free in the DOM: Core & HTML component

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100818

Sandbox escape due to use-after-free in the Widget: Gtk component

Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100819

Sandbox escape due to incorrect boundary conditions in the XPCOM component

Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100828

Mitigation bypass in the Bookmarks & History component

Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.6

CVE-2026-100829

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Critical 9.1

CVE-2026-100763

Incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100757

Use-after-free in the Widget component

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100761

Privilege escalation due to use-after-free in the Graphics: WebGPU component

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100764

Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component

Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100765

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100767

Use-after-free in the Networking: Cache component

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100768

Use-after-free in the Graphics: WebGPU component

Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100769

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100772

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100773

Use-after-free in the Storage: IndexedDB component

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100774

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100776

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100777

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100779

Use-after-free in the XSLT component

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100780

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100782

Privilege escalation due to incorrect boundary conditions in the Graphics component

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100784

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100785

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100789

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100790

Use-after-free in the XSLT component

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100791

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100796

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100797

Privilege escalation due to use-after-free in the Graphics: WebRender component

Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100801

Privilege escalation in the DLL Services component

Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100807

Privilege escalation in the DOM: Service Workers component

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100808

Mitigation bypass in the DOM: Service Workers component

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100813

Invalid pointer in the JavaScript Engine: JIT component

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100814

Incorrect boundary conditions in the JavaScript Engine: JIT component

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100815

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100820

Privilege escalation in the Address Bar component

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100824

Privilege escalation in the Places component

Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100825

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100831

Use-after-free in the DOM: UI Events & Focus Handling component

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.8

CVE-2026-100832

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian

Sep 29, 2026
High 8.1

CVE-2026-100756

Incorrect boundary conditions in the Audio/Video: Playback component

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.1

CVE-2026-100759

Uninitialized memory in the Storage: Quota Manager component

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.1

CVE-2026-100771

Undefined behavior in the DOM: Streams component

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.1

CVE-2026-100798

Cryptography misuse in Storage: Quota Manager component

Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.1

CVE-2026-100803

Same-origin policy bypass in the WebExtensions component

Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.1

CVE-2026-100809

Same-origin policy bypass in the DevTools component

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.1

CVE-2026-100816

Site isolation issue in the DOM: Networking component

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 8.1

CVE-2026-100830

Mitigation bypass in the DOM: Navigation component

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
High 7.5

CVE-2026-100805

Race condition, use-after-free in the Audio/Video component

Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
High 7.1

CVE-2026-100792

JIT miscompilation in the JavaScript: WebAssembly component

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 6.5

CVE-2026-100793

JIT miscompilation in the JavaScript Engine component

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
Medium 6.5

CVE-2026-100795

Denial-of-service in the Networking component

Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
Medium 6.5

CVE-2026-100812

Denial-of-service in the Graphics component

Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 6.5

CVE-2026-100826

Denial-of-service in the Storage: StorageManager component

Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 6.3

CVE-2026-103500

Heap buffer overflow opening large email

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu

Sep 30, 2026
Medium 5.4

CVE-2026-100817

Other issue in the JavaScript: WebAssembly component

Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
Medium 5.4

CVE-2026-100822

Spoofing issue in the Networking: HTTP component

Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 5.4

CVE-2026-100823

Spoofing issue in the Downloads component in Firefox for Android

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.

Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu

Sep 29, 2026
Medium 4.7

CVE-2026-100821

Site isolation issue in the Panning and Zooming component

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 4.3

CVE-2026-100766

Information disclosure in the Networking: JAR component

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 4.3

CVE-2026-100783

Uninitialized memory in the Audio/Video component

Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 4.3

CVE-2026-100799

Uninitialized memory in the Graphics: WebGPU component

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
Medium 4.3

CVE-2026-100802

Uninitialized memory in the Graphics: WebGPU component

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 29, 2026
Medium 4.3

CVE-2026-100806

Uninitialized memory in the Graphics: WebGPU component

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026
Medium 4.3

CVE-2026-96869

Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Sep 29, 2026

Revision history

2026-11-12 #24
Neue Updates von SUSE aufgenommen
2026-11-11 #23
Neue Updates von SUSE aufgenommen
2026-11-09 #22
Neue Updates von Oracle Linux und SUSE aufgenommen
2026-11-08 #21
Neue Updates von Oracle Linux aufgenommen
2026-11-04 #20
Neue Updates von Oracle Linux aufgenommen
2026-11-03 #19
Neue Updates von Oracle Linux aufgenommen
2026-11-02 #18
Neue Updates von Red Hat aufgenommen
2026-11-01 #17
Neue Updates von Amazon aufgenommen
2026-10-29 #16
Neue Updates von SUSE aufgenommen
2026-10-28 #15
Neue Updates von Red Hat, Debian und Oracle Linux aufgenommen
2026-10-27 #14
Neue Updates von Red Hat aufgenommen
2026-10-25 #13
Neue Updates von Amazon aufgenommen
2026-10-22 #12
Neue Updates von openSUSE aufgenommen
2026-10-19 #11
Neue Updates von Red Hat aufgenommen
2026-10-13 #10
Neue Updates von Oracle Linux aufgenommen
2026-10-12 #9
Neue Updates von Amazon, Oracle Linux und SUSE aufgenommen
2026-10-11 #8
Neue Updates von Red Hat aufgenommen
2026-10-08 #7
Neue Updates von Oracle Linux aufgenommen
2026-10-07 #6
Neue Updates von Oracle Linux aufgenommen
2026-10-06 #5
Neue Updates von SUSE aufgenommen
2026-10-04 #4
Neue Updates von Debian, SUSE und openSUSE aufgenommen
2026-10-01 #3
Neue Updates von Debian aufgenommen
2026-09-30 #2
Thunderbird hinzugefügt
2026-09-29 #1
Initiale Fassung

References

Mozilla Security Advisory mfsa2026-100 vom 2026-09-29
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/
Mozilla Security Advisory mfsa2026-97 vom 2026-09-29
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/
Mozilla Security Advisory mfsa2026-98 vom 2026-09-29
https://www.mozilla.org/en-US/security/advisories/mfsa2026-98/
Mozilla Security Advisory mfsa2026-99 vom 2026-09-29
https://www.mozilla.org/en-US/security/advisories/mfsa2026-99/
Mozilla Security Advisory MFSA 2026-101 vom 2026-09-30
https://www.mozilla.org/en-US/security/advisories/mfsa2026-101
Mozilla Security Advisory MFSA 2026-102 vom 2026-09-30
https://www.mozilla.org/en-US/security/advisories/mfsa2026-102
Mozilla Security Advisory MFSA 2026-103 vom 2026-09-30
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103
Debian Security Advisory DSA-6533 vom 2026-09-30
https://security-tracker.debian.org/tracker/DSA-6533-1
Debian Security Advisory DLA-4814 vom 2026-10-02
https://lists.debian.org/debian-lts-announce/2026/10/msg00006.html
Debian Security Advisory DLA-4810 vom 2026-10-02
https://lists.debian.org/debian-lts-announce/2026/10/msg00002.html
Debian Security Advisory DSA-6536 vom 2026-10-02
https://security-tracker.debian.org/tracker/DSA-6536-1
SUSE Security Update SUSE-SU-2026:23981-1 vom 2026-10-05
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029546.html
openSUSE Security Update OPENSUSE-SU-2026:11917-1 vom 2026-10-03
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U5AZYK45IJW2DNRADMDCOEVRBYTZNCQY/
SUSE Security Update SUSE-SU-2026:4545-1 vom 2026-10-06
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029616.html
SUSE Security Update SUSE-SU-2026:4543-1 vom 2026-10-06
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029618.html
Oracle Linux Security Advisory ELSA-2026-76764 vom 2026-10-07
https://linux.oracle.com/errata/ELSA-2026-76764.html
Oracle Linux Security Advisory ELSA-2026-76761 vom 2026-10-08
https://linux.oracle.com/errata/ELSA-2026-76761.html
Oracle Linux Security Advisory ELSA-2026-76850 vom 2026-10-09
https://linux.oracle.com/errata/ELSA-2026-76850.html
Red Hat Security Advisory RHSA-2026:80674 vom 2026-10-12
https://access.redhat.com/errata/RHSA-2026:80674
Red Hat Security Advisory RHSA-2026:80694 vom 2026-10-12
https://access.redhat.com/errata/RHSA-2026:80694
Amazon Linux Security Advisory ALAS2FIREFOX-2026-066 vom 2026-10-13
https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2026-066.html
Oracle Linux Security Advisory ELSA-2026-80674 vom 2026-10-12
http://linux.oracle.com/errata/ELSA-2026-80674.html
SUSE Security Update SUSE-SU-2026:4627-1 vom 2026-10-12
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029779.html
Oracle Linux Security Advisory ELSA-2026-80694 vom 2026-10-13
https://linux.oracle.com/errata/ELSA-2026-80694.html
Red Hat Security Advisory RHSA-2026:85242 vom 2026-10-19
https://access.redhat.com/errata/RHSA-2026:85242
Red Hat Security Advisory RHSA-2026:85241 vom 2026-10-19
https://access.redhat.com/errata/RHSA-2026:85241
Red Hat Security Advisory RHSA-2026:85240 vom 2026-10-19
https://access.redhat.com/errata/RHSA-2026:85240
Red Hat Security Advisory RHSA-2026:85244 vom 2026-10-19
https://access.redhat.com/errata/RHSA-2026:85244
openSUSE Security Update OPENSUSE-SU-2026:12098-1 vom 2026-10-22
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HJKU6TT2E5K53YCVPTZIZCOVJLFCSVKB/
openSUSE Security Update OPENSUSE-SU-2026:12097-1 vom 2026-10-22
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R643FNZFDAT2YNKI3VEMMUIDXEAPF7N4/
Amazon Linux Security Advisory ALAS2FIREFOX-2026-067 vom 2026-10-25
https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2026-067.html
Rocky Linux Security Advisory RLSA-2026:76764 vom 2026-10-24
https://errata.build.resf.org/RLSA-2026:76764
Rocky Linux Security Advisory RLSA-2026:80674 vom 2026-10-24
https://errata.build.resf.org/RLSA-2026:80674
Rocky Linux Security Advisory RLSA-2026:76850 vom 2026-10-24
https://errata.build.resf.org/RLSA-2026:76850
Rocky Linux Security Advisory RLSA-2026:76761 vom 2026-10-24
https://errata.build.resf.org/RLSA-2026:76761
Rocky Linux Security Advisory RLSA-2026:80694 vom 2026-10-24
https://errata.build.resf.org/RLSA-2026:80694
Red Hat Security Advisory RHSA-2026:90913 vom 2026-10-27
https://access.redhat.com/errata/RHSA-2026:90913
Red Hat Security Advisory RHSA-2026:91634 vom 2026-10-28
https://access.redhat.com/errata/RHSA-2026:91634
Red Hat Security Advisory RHSA-2026:91633 vom 2026-10-28
https://access.redhat.com/errata/RHSA-2026:91633
Red Hat Security Advisory RHSA-2026:92011 vom 2026-10-28
https://access.redhat.com/errata/RHSA-2026:92011
Red Hat Security Advisory RHSA-2026:92226 vom 2026-10-29
https://access.redhat.com/errata/RHSA-2026:92226
Red Hat Security Advisory RHSA-2026:92227 vom 2026-10-29
https://access.redhat.com/errata/RHSA-2026:92227
Red Hat Security Advisory RHSA-2026:92335 vom 2026-10-29
https://access.redhat.com/errata/RHSA-2026:92335
Red Hat Security Advisory RHSA-2026:92228 vom 2026-10-29
https://access.redhat.com/errata/RHSA-2026:92228
Debian Security Advisory DSA-6590 vom 2026-10-29
https://security-tracker.debian.org/tracker/DSA-6590-1
Red Hat Security Advisory RHSA-2026:92327 vom 2026-10-29
https://access.redhat.com/errata/RHSA-2026:92327
Oracle Linux Security Advisory ELSA-2026-90913 vom 2026-10-28
http://linux.oracle.com/errata/ELSA-2026-90913.html
Red Hat Security Advisory RHSA-2026:92012 vom 2026-10-28
https://access.redhat.com/errata/RHSA-2026:92012
Red Hat Security Advisory RHSA-2026:92363 vom 2026-10-29
https://access.redhat.com/errata/RHSA-2026:92363
SUSE Security Update SUSE-SU-2026:4928-1 vom 2026-10-29
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030249.html
Amazon Linux Security Advisory ALAS2-2026-4057 vom 2026-10-31
https://alas.aws.amazon.com/AL2/ALAS2-2026-4057.html
Red Hat Security Advisory RHSA-2026:94405 vom 2026-11-03
https://access.redhat.com/errata/RHSA-2026:94405
Red Hat Security Advisory RHSA-2026:93956 vom 2026-11-02
https://access.redhat.com/errata/RHSA-2026:93956
Oracle Linux Security Advisory ELSA-2026-94405 vom 2026-11-03
https://linux.oracle.com/errata/ELSA-2026-94405.html
Oracle Linux Security Advisory ELSA-2026-93957 vom 2026-11-03
https://linux.oracle.com/errata/ELSA-2026-93957.html
Oracle Linux Security Advisory ELSA-2026-93956 vom 2026-11-04
https://linux.oracle.com/errata/ELSA-2026-93956.html
Oracle Linux Security Advisory ELSA-2026-92363 vom 2026-11-06
https://linux.oracle.com/errata/ELSA-2026-92363.html
Oracle Linux Security Advisory ELSA-2026-96079 vom 2026-11-09
https://linux.oracle.com/errata/ELSA-2026-96079.html
SUSE Security Update SUSE-SU-2026:5145-1 vom 2026-11-09
https://lists.suse.com/pipermail/sle-security-updates/2026-November/030497.html
Oracle Linux Security Advisory ELSA-2026-96081 vom 2026-11-09
https://linux.oracle.com/errata/ELSA-2026-96081.html
SUSE Security Update SUSE-SU-2026:24661-1 vom 2026-11-11
https://lists.suse.com/pipermail/sle-security-updates/2026-November/030602.html
SUSE Security Update SUSE-SU-2026:24704-1 vom 2026-11-12
https://lists.suse.com/pipermail/sle-security-updates/2026-November/030637.html
IGEL Security Notice ISN-2026-47 vom 2026-11-12
https://kb.igel.com/en/security-safety/current/isn-2026-47-firefox-esr-vulnerabilities