Threats affecting pkg:deb/debian/firefox

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVE-2026-16374 is an information disclosure vulnerability in the Framework component of DevTools. It was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability could allow unauthorized access to sensitive information through the affected component. No known exploits in the wild have been reported.

CVE-2026-16353 is a critical security vulnerability involving an invalid pointer in the DOM: Bindings (WebIDL) component of Mozilla Firefox and Thunderbird. This flaw was addressed and fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability could lead to memory corruption issues. No known exploits in the wild have been reported. The fix is officially available from Mozilla as part of their security advisories.

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.