CVE-2026-118008 is a high-severity privilege escalation vulnerability in the DOM Navigation component of Mozilla Firefox. It allows an attacker to escalate privileges within the browser environment. This vulnerability was fixed in Firefox version 159.
Multiple security vulnerabilities affecting Mozilla Firefox Extended Support Release (ESR) 140.14.0 and related Thunderbird versions have been addressed in a security update. The issues include privilege escalations, use-after-free bugs, information disclosures, site isolation problems, mitigation bypasses, race conditions, integer overflows, and same-origin policy bypasses across various components such as Graphics, DOM, Networking, JavaScript, and Storage. These vulnerabilities were fixed in Firefox ESR 140.14.0 and corresponding Thunderbird packages.
Multiple security vulnerabilities have been identified and fixed in Mozilla Thunderbird, including sandbox escapes, information disclosure, memory safety bugs, denial-of-service, privilege escalation, mitigation bypasses, and boundary condition errors. These issues affect Thunderbird ESR 140.12 and related Firefox versions. Red Hat has released security updates for Thunderbird in Red Hat Enterprise Linux 9.6 Extended Update Support to address these vulnerabilities.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Other issue in the WebRTC component (CVE-2026-8094)
* firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092)
* firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)
* firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)
* firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)
* firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.