Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: - Update to Firefox Extended Support Release 140.13.0 ESR. - MFSA 2026-70 (bsc#1271649): * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component * CVE-2026-15719: Site isolation issue in the DOM: Navigation component * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16357: Incorrect boundary conditions in the Graphics component * CVE-2026-16371: Privilege escalation in the DOM: Navigation component * CVE-2026-16374: Information disclosure in the Framework component in DevTools * CVE-2026-16375: Site isolation issue in the Networking: HTTP component * CVE-2026-16377: Mitigation bypass in the PDF Viewer component * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component * CVE-2026-16383: Mitigation bypass in the DOM: Networking component * CVE-2026-16387: Site isolation issue in the Networking component * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component * CVE-2026-16396: Privilege escalation in WebExtensions * CVE-2026-16405: Information disclosure in the Networking: WebSockets component * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 - Remove obsolete `mozilla-nss-certs` (bsc#1269226).
AI Analysis
Technical Summary
This Red Hat security advisory addresses a set of 29 vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes in DOM and Security Process Sandboxing components, information disclosure, memory safety bugs, JIT miscompilation, mitigation bypasses, privilege escalation in the Graphics WebRender component, denial-of-service in Graphics ImageLib, same-origin policy bypass, use-after-free in Networking HTTP, and incorrect boundary conditions in multiple components. The vulnerabilities affect Firefox ESR 140.12, Firefox 152, Thunderbird ESR 140.12, and Thunderbird 152 running on Red Hat Enterprise Linux 10. The update fixes these issues by patching the affected components to prevent exploitation. The advisory rates the security impact as Important (high severity).
Potential Impact
The vulnerabilities collectively allow for potential sandbox escapes, information disclosure, privilege escalation, denial-of-service, and memory safety issues in Firefox and Thunderbird on Red Hat Enterprise Linux 10. These could lead to unauthorized code execution, data leaks, application crashes, or bypass of security mitigations. The CVSS vector for CVE-2026-12289 indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts. The overall impact is high, affecting the confidentiality, integrity, and availability of the affected applications.
Mitigation Recommendations
A security update for Firefox and Thunderbird is available for Red Hat Enterprise Linux 10, specifically firefox-0:140.12.0-1.el10_2.x86_64 and related packages. Users should apply this update promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.
Security update for MozillaFirefox
Description
This update for MozillaFirefox fixes the following issues: - Update to Firefox Extended Support Release 140.13.0 ESR. - MFSA 2026-70 (bsc#1271649): * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component * CVE-2026-15719: Site isolation issue in the DOM: Navigation component * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-16357: Incorrect boundary conditions in the Graphics component * CVE-2026-16371: Privilege escalation in the DOM: Navigation component * CVE-2026-16374: Information disclosure in the Framework component in DevTools * CVE-2026-16375: Site isolation issue in the Networking: HTTP component * CVE-2026-16377: Mitigation bypass in the PDF Viewer component * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component * CVE-2026-16383: Mitigation bypass in the DOM: Networking component * CVE-2026-16387: Site isolation issue in the Networking component * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component * CVE-2026-16396: Privilege escalation in WebExtensions * CVE-2026-16405: Information disclosure in the Networking: WebSockets component * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 - Remove obsolete `mozilla-nss-certs` (bsc#1269226).
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses a set of 29 vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes in DOM and Security Process Sandboxing components, information disclosure, memory safety bugs, JIT miscompilation, mitigation bypasses, privilege escalation in the Graphics WebRender component, denial-of-service in Graphics ImageLib, same-origin policy bypass, use-after-free in Networking HTTP, and incorrect boundary conditions in multiple components. The vulnerabilities affect Firefox ESR 140.12, Firefox 152, Thunderbird ESR 140.12, and Thunderbird 152 running on Red Hat Enterprise Linux 10. The update fixes these issues by patching the affected components to prevent exploitation. The advisory rates the security impact as Important (high severity).
Potential Impact
The vulnerabilities collectively allow for potential sandbox escapes, information disclosure, privilege escalation, denial-of-service, and memory safety issues in Firefox and Thunderbird on Red Hat Enterprise Linux 10. These could lead to unauthorized code execution, data leaks, application crashes, or bypass of security mitigations. The CVSS vector for CVE-2026-12289 indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts. The overall impact is high, affecting the confidentiality, integrity, and availability of the affected applications.
Mitigation Recommendations
A security update for Firefox and Thunderbird is available for Red Hat Enterprise Linux 10, specifically firefox-0:140.12.0-1.el10_2.x86_64 and related packages. Users should apply this update promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:27733
- Cve Count
- 29
- Additional Cves
- ["CVE-2026-12290","CVE-2026-12291","CVE-2026-12292","CVE-2026-12294","CVE-2026-12295","CVE-2026-12296","CVE-2026-12297","CVE-2026-12298","CVE-2026-12299","CVE-2026-12302","CVE-2026-12304","CVE-2026-12305","CVE-2026-12306","CVE-2026-12307","CVE-2026-12308","CVE-2026-12309","CVE-2026-12310","CVE-2026-12311","CVE-2026-12312","CVE-2026-12313","CVE-2026-12314","CVE-2026-12315","CVE-2026-12324","CVE-2026-12325","CVE-2026-12327","CVE-2026-12328","CVE-2026-12329","CVE-2026-12330"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a395a05eed863c81e08e773
Added to database: 06/22/2026, 15:51:33 UTC
Last enriched: 07/15/2026, 14:23:37 UTC
Last updated: 09/21/2026, 10:39:57 UTC
Views: 191
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.