RHSA-2026:76761HighCVSS 7.5

Red Hat Security Advisory: firefox security update

Published
October 8, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (43)

CVE-2026-100785 →CVE-2026-100790 →CVE-2026-100797 →CVE-2026-100832 →CVE-2026-92035 →CVE-2026-100775 →CVE-2026-100792 →CVE-2026-100770 →CVE-2026-100776 →CVE-2026-100781 →CVE-2026-100783 →CVE-2026-100786 →CVE-2026-100807 →CVE-2026-100811 →CVE-2026-100820 →CVE-2026-100767 →CVE-2026-100771 →CVE-2026-100778 →CVE-2026-100780 →CVE-2026-100784 →CVE-2026-100788 →CVE-2026-100803 →CVE-2026-100819 →CVE-2026-100762 →CVE-2026-100801 →CVE-2026-100821 →CVE-2026-96869 →CVE-2026-100756 →CVE-2026-100772 →CVE-2026-100774 →CVE-2026-100789 →CVE-2026-100794 →CVE-2026-100818 →CVE-2026-100766 →CVE-2026-100769 →CVE-2026-100791 →CVE-2026-100758 →CVE-2026-100773 →CVE-2026-100777 →CVE-2026-100782 →CVE-2026-100757 →CVE-2026-100759 →CVE-2026-100779 →

📋 Description

CVE-2026-92035 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-96869 — firefox: thunderbird: Information disclosure in the Networking component CVE-2026-100756 — firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component CVE-2026-100757 — firefox: thunderbird: Use-after-free in the Widget component CVE-2026-100758 — firefox: thunderbird: Sandbox escape in the DOM: Navigation component CVE-2026-100759 — firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component CVE-2026-100762 — firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component CVE-2026-100766 — firefox: thunderbird: Information disclosure in the Networking: JAR component CVE-2026-100767 — firefox: thunderbird: Use-after-free in the Networking: Cache component CVE-2026-100769 — firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component CVE-2026-100770 — firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component CVE-2026-100771 — firefox: thunderbird: Undefined behavior in the DOM: Streams component CVE-2026-100772 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-100773 — firefox: thunderbird: Use-after-free in the Storage: IndexedDB component CVE-2026-100774 — firefox: Use-after-free in the DOM: Core & HTML component CVE-2026-100775 — firefox: thunderbird: Sandbox escape in the Graphics component CVE-2026-100776 — firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component CVE-2026-100777 — firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100778 — firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component CVE-2026-100779 — firefox: thunderbird: Use-after-free in the XSLT component CVE-2026-100780 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-100781 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component CVE-2026-100782 — firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component CVE-2026-100783 — firefox: thunderbird: Uninitialized memory in the Audio/Video component CVE-2026-100784 — firefox: Use-after-free in the Layout: Text and Fonts component CVE-2026-100785 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-100786 — firefox: Sandbox escape due to use-after-free in the Graphics component CVE-2026-100788 — firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-100789 — firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100790 — firefox: thunderbird: Use-after-free in the XSLT component CVE-2026-100791 — firefox: Use-after-free in the DOM: Core & HTML component CVE-2026-100792 — firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component CVE-2026-100794 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component CVE-2026-100797 — firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component CVE-2026-100801 — firefox: thunderbird: Privilege escalation in the DLL Services component CVE-2026-100803 — firefox: thunderbird: Same-origin policy bypass in the WebExtensions component CVE-2026-100807 — firefox: thunderbird: Privilege escalation in the DOM: Service Workers component CVE-2026-100811 — firefox: firefox: Sandbox escape via use-after-free in DOM component CVE-2026-100818 — firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component CVE-2026-100819 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component CVE-2026-100820 — firefox: thunderbird: Privilege escalation in the Address Bar component CVE-2026-100821 — firefox: thunderbird: Site isolation issue in the Panning and Zooming component CVE-2026-100832 — firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:140.17.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:140.17.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:140.17.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:140.17.0-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:140.17.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:140.17.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:140.17.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:140.17.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:140.17.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:140.17.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:140.17.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:140.17.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:140.17.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:140.17.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:140.17.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:140.17.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:140.17.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Mozilla addressed this flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 (and the corresponding Thunderbird releases); updating to a version that includes the upstream fix is the available remediation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upstream Mozilla has fixed this issue in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; for Red Hat products, update the firefox and thunderbird packages to a version containing the fix once it is released through the standard Red Hat update channels.

🔗 References (46)