{"id":"RLSA-2026:76850","summary":"Important: firefox security update","details":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n\n* firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n\n* firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794)\n\n* firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777)\n\n* firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766)\n\n* firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792)\n\n* firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776)\n\n* firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757)\n\n* firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786)\n\n* firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769)\n\n* firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100791)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782)\n\n* firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100772)\n\n* firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVE-2026-100778)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758)\n\n* firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781)\n\n* firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100774)\n\n* firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100785)\n\n* firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788)\n\n* firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762)\n\n* firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790)\n\n* firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100780)\n\n* firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756)\n\n* firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","modified":"2026-10-24T00:30:02.741761692Z","published":"2026-10-24T00:01:21.638628Z","upstream":["CVE-2026-100756","CVE-2026-100757","CVE-2026-100758","CVE-2026-100759","CVE-2026-100762","CVE-2026-100766","CVE-2026-100767","CVE-2026-100769","CVE-2026-100770","CVE-2026-100771","CVE-2026-100772","CVE-2026-100773","CVE-2026-100774","CVE-2026-100775","CVE-2026-100776","CVE-2026-100777","CVE-2026-100778","CVE-2026-100779","CVE-2026-100780","CVE-2026-100781","CVE-2026-100782","CVE-2026-100783","CVE-2026-100784","CVE-2026-100785","CVE-2026-100786","CVE-2026-100788","CVE-2026-100789","CVE-2026-100790","CVE-2026-100791","CVE-2026-100792","CVE-2026-100794","CVE-2026-100797","CVE-2026-100801","CVE-2026-100803","CVE-2026-100807","CVE-2026-100811","CVE-2026-100818","CVE-2026-100819","CVE-2026-100820","CVE-2026-100821","CVE-2026-100832","CVE-2026-92035","CVE-2026-96869"],"database_specific":{"license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","source_advisory":"RHSA-2026:76850"},"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:76850"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533789"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543113"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543114"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543116"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543120"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543121"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543123"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543125"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543128"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543130"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543131"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543133"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543134"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543137"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543140"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543142"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543144"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543145"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543146"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543149"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543150"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543152"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543154"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543155"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543156"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543157"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543159"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543160"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543161"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543163"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543164"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543166"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543167"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543172"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543174"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543177"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543182"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543183"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543185"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543187"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543188"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543192"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543193"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:76850"}],"affected":[{"package":{"name":"firefox","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/firefox?distro=rocky-linux-8&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.17.0-1.el8_10"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:76850.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}