Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: - Update to Firefox Extended Support Release 140.13.0 ESR. - MFSA 2026-70 (bsc#1271649): * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component * CVE-2026-15719: Site isolation issue in the DOM: Navigation component * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16357: Incorrect boundary conditions in the Graphics component * CVE-2026-16371: Privilege escalation in the DOM: Navigation component * CVE-2026-16374: Information disclosure in the Framework component in DevTools * CVE-2026-16375: Site isolation issue in the Networking: HTTP component * CVE-2026-16377: Mitigation bypass in the PDF Viewer component * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component * CVE-2026-16383: Mitigation bypass in the DOM: Networking component * CVE-2026-16387: Site isolation issue in the Networking component * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component * CVE-2026-16396: Privilege escalation in WebExtensions * CVE-2026-16405: Information disclosure in the Networking: WebSockets component * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 - Remove obsolete `mozilla-nss-certs` (bsc#1269226).
AI Analysis
Technical Summary
This Red Hat security advisory addresses a set of 29 vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes in DOM and Security Process Sandboxing components, information disclosure, memory safety bugs, mitigation bypasses, privilege escalation in the Graphics WebRender component, denial-of-service in the Graphics ImageLib component, and same-origin policy bypass in the Networking Cookies component. The fixes apply to Firefox ESR 140.12, Firefox 152, Thunderbird ESR 140.12, and Thunderbird 152 versions distributed with Red Hat Enterprise Linux 8. The vulnerabilities span multiple CWE categories such as CWE-266 (Privilege Escalation), CWE-787 (Out-of-bounds Write), CWE-823 (Use After Free), and others. The advisory is identified as RHSA-2026:27717 and rates the update as having an Important security impact.
Potential Impact
The vulnerabilities could allow attackers to escape sandbox restrictions, disclose sensitive information, escalate privileges, cause denial-of-service conditions, bypass mitigations, and violate same-origin policies. These impacts affect the security boundaries and memory safety of Firefox and Thunderbird, potentially compromising confidentiality, integrity, and availability of affected systems. The severity is rated high by the source, reflecting significant risk if unpatched.
Mitigation Recommendations
A security update for Firefox and Thunderbird is available for Red Hat Enterprise Linux 8, including ESR 140.12 and version 152 releases. Users should apply the update as per Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate these vulnerabilities. The advisory RHSA-2026:27717 provides detailed instructions. No indication of no-action or partial mitigation is stated; therefore, applying the official update is recommended.
Security update for MozillaFirefox
Description
This update for MozillaFirefox fixes the following issues: - Update to Firefox Extended Support Release 140.13.0 ESR. - MFSA 2026-70 (bsc#1271649): * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component * CVE-2026-15719: Site isolation issue in the DOM: Navigation component * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16357: Incorrect boundary conditions in the Graphics component * CVE-2026-16371: Privilege escalation in the DOM: Navigation component * CVE-2026-16374: Information disclosure in the Framework component in DevTools * CVE-2026-16375: Site isolation issue in the Networking: HTTP component * CVE-2026-16377: Mitigation bypass in the PDF Viewer component * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component * CVE-2026-16383: Mitigation bypass in the DOM: Networking component * CVE-2026-16387: Site isolation issue in the Networking component * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component * CVE-2026-16396: Privilege escalation in WebExtensions * CVE-2026-16405: Information disclosure in the Networking: WebSockets component * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 - Remove obsolete `mozilla-nss-certs` (bsc#1269226).
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses a set of 29 vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes in DOM and Security Process Sandboxing components, information disclosure, memory safety bugs, mitigation bypasses, privilege escalation in the Graphics WebRender component, denial-of-service in the Graphics ImageLib component, and same-origin policy bypass in the Networking Cookies component. The fixes apply to Firefox ESR 140.12, Firefox 152, Thunderbird ESR 140.12, and Thunderbird 152 versions distributed with Red Hat Enterprise Linux 8. The vulnerabilities span multiple CWE categories such as CWE-266 (Privilege Escalation), CWE-787 (Out-of-bounds Write), CWE-823 (Use After Free), and others. The advisory is identified as RHSA-2026:27717 and rates the update as having an Important security impact.
Potential Impact
The vulnerabilities could allow attackers to escape sandbox restrictions, disclose sensitive information, escalate privileges, cause denial-of-service conditions, bypass mitigations, and violate same-origin policies. These impacts affect the security boundaries and memory safety of Firefox and Thunderbird, potentially compromising confidentiality, integrity, and availability of affected systems. The severity is rated high by the source, reflecting significant risk if unpatched.
Mitigation Recommendations
A security update for Firefox and Thunderbird is available for Red Hat Enterprise Linux 8, including ESR 140.12 and version 152 releases. Users should apply the update as per Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate these vulnerabilities. The advisory RHSA-2026:27717 provides detailed instructions. No indication of no-action or partial mitigation is stated; therefore, applying the official update is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:27717
- Cve Count
- 29
- Additional Cves
- ["CVE-2026-12290","CVE-2026-12291","CVE-2026-12292","CVE-2026-12294","CVE-2026-12295","CVE-2026-12296","CVE-2026-12297","CVE-2026-12298","CVE-2026-12299","CVE-2026-12302","CVE-2026-12304","CVE-2026-12305","CVE-2026-12306","CVE-2026-12307","CVE-2026-12308","CVE-2026-12309","CVE-2026-12310","CVE-2026-12311","CVE-2026-12312","CVE-2026-12313","CVE-2026-12314","CVE-2026-12315","CVE-2026-12324","CVE-2026-12325","CVE-2026-12327","CVE-2026-12328","CVE-2026-12329","CVE-2026-12330"]
- State
- PUBLISHED
Threat ID: 6a395a05eed863c81e08e724
Added to database: 06/22/2026, 15:51:33 UTC
Last enriched: 07/15/2026, 14:24:08 UTC
Last updated: 09/21/2026, 10:40:02 UTC
Views: 157
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.