Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: firefox security update

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 8.4. These include use-after-free bugs, memory safety issues, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypasses across various components such as the JavaScript engine, graphics, audio/video, WebRTC, and networking. The update fixes these issues in Firefox ESR 115.34, ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149. The vulnerabilities have been rated with a high severity impact by Red Hat Product Security. No known exploits in the wild have been reported at this time.

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in Red Hat Enterprise Linux 9.6 Extended Update Support. These include use-after-free bugs, memory safety issues, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypasses across various components such as the JavaScript engine, graphics, audio/video, WebRTC, XPCOM, and others. The update fixes these issues in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149.

Multiple security vulnerabilities have been identified and fixed in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass issues. These vulnerabilities affect various components such as the JavaScript Engine, Graphics (Canvas2D, WebRender, Text), Audio/Video (Web Codecs, Playback, GMP), WebRTC Signaling, XPCOM, CSS Parsing, Layout, Widget Cocoa, Netmonitor, Disability Access APIs, Responsive Design Mode, Telemetry, and Networking HTTP. The fixes are included in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149, and updates are available for Red Hat Enterprise Linux 8.8 variants.

Multiple security vulnerabilities have been identified and addressed in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, and denial-of-service issues across various components such as the JavaScript engine, graphics, audio/video, WebRTC, and others. These issues affect Red Hat Enterprise Linux 9.2 distributions with Firefox versions prior to the updated ESR 140.9 and Firefox 149 releases. The vulnerabilities have been fixed in updated packages provided by Red Hat.

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update. These include use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass issues across various components such as the JavaScript engine, graphics, audio/video, WebRTC, XPCOM, and others. The update targets Red Hat Enterprise Linux 9.0 and related packages. The vulnerabilities have been rated with high severity by Red Hat Product Security.

Multiple security vulnerabilities have been identified and fixed in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass issues. These vulnerabilities affect various components such as the JavaScript engine, graphics, audio/video, WebRTC, XPCOM, and others. The fixes are included in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149, and are available for Red Hat Enterprise Linux 8.2 AUS. The update addresses a broad range of security issues rated as important by Red Hat Product Security.

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 8. These include use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass issues across various components such as the JavaScript engine, graphics, audio/video, WebRTC, and networking. The update fixes these issues in Firefox ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149.

security update for firefox

firefox

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in Red Hat Enterprise Linux 9 updates. These include use-after-free bugs, memory safety issues, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypasses across various components such as the JavaScript engine, graphics subsystems, WebRTC signaling, and networking. The update fixes these issues in Firefox ESR 115.34, ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149.

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in Red Hat Enterprise Linux 10 updates. These include use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass issues across various components such as the JavaScript engine, graphics, audio/video, WebRTC, XPCOM, and others. The update fixes these issues in Firefox ESR 115.34, ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149.

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Search: CVE-2026-4684