{"id":"OESA-2026-4675","summary":"firefox security update","details":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.\r\n\r\nSecurity Fix(es):\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117860)\n\nSandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117861)\n\nPrivilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117862)\n\nInformation disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117863)\n\nSandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117864)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117865)\n\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117866)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117867)\n\nSandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117868)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117869)\n\nUse-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117870)\n\nInvalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117871)\n\nUse-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117872)\n\nIncorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117873)\n\nUse-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117874)\n\nUse-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117875)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117876)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117877)\n\nOther issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117878)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117879)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117880)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117881)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117882)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117883)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117884)\n\nUse-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117885)\n\nIncorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117886)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117887)\n\nUninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117888)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117889)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117890)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117891)\n\nPrivilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117892)\n\nIncorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117893)\n\nIncorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117894)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117895)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117896)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117897)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117898)\n\nUse-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117899)\n\nUse-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117900)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117901)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117902)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117903)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117904)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117905)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117906)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117907)\n\nUse-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117908)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117909)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117910)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117911)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117912)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117913)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117914)\n\nIncorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117915)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117916)\n\nInvalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117917)\n\nUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117918)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117919)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117920)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117921)\n\nUse-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117922)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117923)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117924)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117925)\n\nIncorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117926)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117927)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117928)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117929)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117930)\n\nUse-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117931)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117932)\n\nFrame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117933)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117934)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117935)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117936)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117937)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117938)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117939)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117940)\n\nUse-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117941)\n\nIncorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117942)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117943)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117944)\n\nIncorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117945)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117946)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117947)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117948)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117949)\n\nIncorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117950)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117951)\n\nUninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117952)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117953)\n\nUse-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117954)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117955)\n\nInvalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117956)\n\nCryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117957)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117958)\n\nSite isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117959)\n\nSpoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117960)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117961)\n\nSandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117962)\n\nIncorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117963)\n\nUse-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117964)\n\nSame-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117965)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117966)\n\nMitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117967)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117968)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117969)\n\nRace condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117970)\n\nSandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117971)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117972)\n\nUse-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117973)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117974)\n\nSandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117975)\n\nSite isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117976)\n\nOther issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117977)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117978)\n\nIncorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117979)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117980)\n\nPrivilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117981)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117982)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117983)\n\nIncorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117984)\n\nSandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117985)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117986)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117987)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117988)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117989)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117990)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117991)\n\nInformation disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117992)\n\nInteger overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117993)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117994)\n\nPrivilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117995)\n\nIncorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117996)\n\nSandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117997)\n\nMitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117998)\n\nRace condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117999)\n\nInformation disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118000)\n\nInformation disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118002)\n\nInformation disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118003)\n\nIncorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118004)","modified":"2026-11-04T14:00:05.227352534Z","published":"2026-11-04T13:54:22Z","upstream":["CVE-2026-117860","CVE-2026-117861","CVE-2026-117862","CVE-2026-117863","CVE-2026-117864","CVE-2026-117865","CVE-2026-117866","CVE-2026-117867","CVE-2026-117868","CVE-2026-117869","CVE-2026-117870","CVE-2026-117871","CVE-2026-117872","CVE-2026-117873","CVE-2026-117874","CVE-2026-117875","CVE-2026-117876","CVE-2026-117877","CVE-2026-117878","CVE-2026-117879","CVE-2026-117880","CVE-2026-117881","CVE-2026-117882","CVE-2026-117883","CVE-2026-117884","CVE-2026-117885","CVE-2026-117886","CVE-2026-117887","CVE-2026-117888","CVE-2026-117889","CVE-2026-117890","CVE-2026-117891","CVE-2026-117892","CVE-2026-117893","CVE-2026-117894","CVE-2026-117895","CVE-2026-117896","CVE-2026-117897","CVE-2026-117898","CVE-2026-117899","CVE-2026-117900","CVE-2026-117901","CVE-2026-117902","CVE-2026-117903","CVE-2026-117904","CVE-2026-117905","CVE-2026-117906","CVE-2026-117907","CVE-2026-117908","CVE-2026-117909","CVE-2026-117910","CVE-2026-117911","CVE-2026-117912","CVE-2026-117913","CVE-2026-117914","CVE-2026-117915","CVE-2026-117916","CVE-2026-117917","CVE-2026-117918","CVE-2026-117919","CVE-2026-117920","CVE-2026-117921","CVE-2026-117922","CVE-2026-117923","CVE-2026-117924","CVE-2026-117925","CVE-2026-117926","CVE-2026-117927","CVE-2026-117928","CVE-2026-117929","CVE-2026-117930","CVE-2026-117931","CVE-2026-117932","CVE-2026-117933","CVE-2026-117934","CVE-2026-117935","CVE-2026-117936","CVE-2026-117937","CVE-2026-117938","CVE-2026-117939","CVE-2026-117940","CVE-2026-117941","CVE-2026-117942","CVE-2026-117943","CVE-2026-117944","CVE-2026-117945","CVE-2026-117946","CVE-2026-117947","CVE-2026-117948","CVE-2026-117949","CVE-2026-117950","CVE-2026-117951","CVE-2026-117952","CVE-2026-117953","CVE-2026-117954","CVE-2026-117955","CVE-2026-117956","CVE-2026-117957","CVE-2026-117958","CVE-2026-117959","CVE-2026-117960","CVE-2026-117961","CVE-2026-117962","CVE-2026-117963","CVE-2026-117964","CVE-2026-117965","CVE-2026-117966","CVE-2026-117967","CVE-2026-117968","CVE-2026-117969","CVE-2026-117970","CVE-2026-117971","CVE-2026-117972","CVE-2026-117973","CVE-2026-117974","CVE-2026-117975","CVE-2026-117976","CVE-2026-117977","CVE-2026-117978","CVE-2026-117979","CVE-2026-117980","CVE-2026-117981","CVE-2026-117982","CVE-2026-117983","CVE-2026-117984","CVE-2026-117985","CVE-2026-117986","CVE-2026-117987","CVE-2026-117988","CVE-2026-117989","CVE-2026-117990","CVE-2026-117991","CVE-2026-117992","CVE-2026-117993","CVE-2026-117994","CVE-2026-117995","CVE-2026-117996","CVE-2026-117997","CVE-2026-117998","CVE-2026-117999","CVE-2026-118000","CVE-2026-118002","CVE-2026-118003","CVE-2026-118004"],"database_specific":{"severity":"Critical"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117860"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117861"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117862"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117863"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117864"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117865"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117866"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117867"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117868"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117869"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117870"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117871"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117872"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117873"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117874"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117875"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117876"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117877"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117878"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117879"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117880"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117881"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117882"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117883"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117884"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117885"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117886"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117887"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117888"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117889"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117890"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117891"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117892"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117893"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117894"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117895"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117896"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117897"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117898"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117899"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117900"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117901"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117902"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117903"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117904"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117905"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117906"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117907"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117908"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117909"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117910"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117911"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117912"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117913"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117914"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117915"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117916"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117917"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117918"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117919"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117920"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117921"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117922"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117923"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117924"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117925"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117926"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117927"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117928"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117929"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117930"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117931"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117932"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117933"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117934"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117935"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117936"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117937"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117938"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117939"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117940"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117941"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117942"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117943"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117944"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117945"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117946"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117947"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117948"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117949"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117950"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117951"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117952"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117953"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117954"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117955"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117956"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117957"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117958"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117959"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117960"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117961"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117962"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117963"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117964"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117965"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117966"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117967"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117968"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117969"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117970"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117971"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117972"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117973"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117974"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117975"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117976"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117977"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117978"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117979"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117980"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117981"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117982"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117983"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117984"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117985"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117986"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117987"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117988"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117989"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117990"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117991"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117992"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117993"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117994"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117995"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117996"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117997"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117998"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117999"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118000"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118002"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118003"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118004"}],"affected":[{"package":{"name":"firefox","ecosystem":"openEuler:24.03-LTS-SP3","purl":"pkg:rpm/openEuler/firefox&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.oe2403sp3"}]}],"ecosystem_specific":{"aarch64":["firefox-153.6.0-1.oe2403sp3.aarch64.rpm","firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64.rpm","firefox-debugsource-153.6.0-1.oe2403sp3.aarch64.rpm"],"src":["firefox-153.6.0-1.oe2403sp3.src.rpm"],"x86_64":["firefox-153.6.0-1.oe2403sp3.x86_64.rpm","firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64.rpm","firefox-debugsource-153.6.0-1.oe2403sp3.x86_64.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4675.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}