CVE-2026-75874

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.(CVE-2026-16365)

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.(CVE-2026-75874)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84143)

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84145)

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.(CVE-2026-16365)

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.(CVE-2026-75874)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84143)

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84145)

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.(CVE-2026-16365)

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.(CVE-2026-75874)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84131)

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84143)

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84145)

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

• thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

• thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

• thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

• firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

• firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

• firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

• firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

• firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

• firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

• firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

• firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

• firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

• firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

• firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

• firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

• firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

• firefox: thunderbird: Privilege escalation due to…

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

• thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

• thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

• thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

• firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

• firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

• firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

• firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

• firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

• firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

• firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

• firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

• firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

• firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

• firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

• firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

• firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

• firefox: thunderbird: Privilege escalation due to…

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

• thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

• thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

• thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

• firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

• firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

• firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

• firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

• firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

• firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

• firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

• firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

• firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

• firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

• firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

• firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

• firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

• firefox: thunderbird: Privilege escalation due to…

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
• thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
• thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
• thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
• firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
• firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
• firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
• firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
• firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
• firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
• firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
• firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
• firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
• firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
• firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
• firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
• firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
• firefox:…

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
• thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
• thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
• thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
• firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
• firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
• firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
• firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
• firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
• firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
• firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
• firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
• firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
• firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
• firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
• firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
• firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
• firefox:…

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
• firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
• firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
• firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
• firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
• firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
• firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
• firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
• thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
• thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
• thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
• firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
• firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
• firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
• firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
• firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
• firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
• firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
• firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
• firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
• firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
• firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
• firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
• firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
• firefox:…

• update to 153.2.0 ESR (MFSA 2026-80, MFSA 2026-88)
• regenerate P11 rust-file-removal: the comm copy of the vendored wast crate changed in 153.2.0, so its one-line .cargo-checksum.json hunk no longer matched (the third_party copy and idna were unaffected)
• CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
• CVE-2026-74935: Privilege escalation in the DOM: Networking component
• CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component
• CVE-2026-74937: Use-after-free in the JavaScript: GC component
• CVE-2026-74938: Mitigation bypass in the JavaScript: GC component
• CVE-2026-74939: Privilege escalation in the DOM: Navigation component
• CVE-2026-74940: Use-after-free in the Graphics: Text component
• CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component
• CVE-2026-74942: Privilege escalation in the Remote Settings Client component
• CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
• CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
• CVE-2026-74945: Information disclosure in the Graphics: Text component
• CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
• CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component
• CVE-2026-74948: Information disclosure in the Graphics component
• CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
• CVE-2026-74952: Privilege escalation in the Application Update component
• CVE-2026-74953: Privilege escalation in the Networking: Cookies component
• CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component
• CVE-2026-74955: Privilege escalation in the Request Handling component
• CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component
• CVE-2026-74957: Mitigation bypass in the Safe Browsing component
• CVE-2026-74958: Information disclosure in the WebRTC component
• CVE-2026-74959: Mitigation bypass in the Storage: Cache API component
• CVE-2026-74960: Site isolation issue in the WebExtensions component
• CVE-2026-74961: Side-channel in the Web Audio component
• CVE-2026-74962: Site isolation issue in the Networking: Cookies component
• CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component
• CVE-2026-74964: Integer overflow in the Graphics component
• CVE-2026-74965: Privilege escalation in the Shell Integration component
• CVE-2026-74966: Information disclosure in the Form Autofill component
• CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component
• CVE-2026-74968: Site isolation issue in the Graphics: WebRender component
• CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
• CVE-2026-74970: Site isolation issue in the Graphics component
• CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling component
• CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component
• CVE-2026-74973: Race condition, use-after-free in the Graphics component
• CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component
• CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-74977: Integer overflow in the Graphics component
• CVE-2026-74978: Clickjacking issue in the Widget component
• CVE-2026-74979: Mitigation bypass in the Add-ons Manager component
• CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component
• CVE-2026-74982: Denial-of-service in the Widget component
• CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component
• CVE-2026-74984: Race condition in the JavaScript Engine component
• CVE-2026-74985: Privilege escalation in the Enterprise Policies component
• CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component
• CVE-2026-74987: Internally found bugs fixed in…

Sandbox escape in the Remote Settings Client component. (CVE-2026-75874) Privilege escalation in the DOM: Workers component. (CVE-2026-16365) Use-after-free in the JavaScript: GC component. (CVE-2026-84118) Sandbox escape due to use-after-free in the DOM: Navigation component. (CVE-2026-84119) Use-after-free in the Audio/Video component. (CVE-2026-84120) Sandbox escape due to use-after-free in the DOM: Security component. (CVE-2026-84121) Use-after-free in the Audio/Video component. (CVE-2026-84122) Privilege escalation due to use-after-free in the Graphics: WebGPU component. (CVE-2026-84123) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125) Privilege escalation in the DOM: Navigation component. (CVE-2026-16371) Privilege escalation in the Application Update component. (CVE-2026-74952) Site isolation issue in the DOM: Navigation component. (CVE-2026-84129) Information disclosure in the Graphics: WebGPU component. (CVE-2026-84130) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-84131) Information disclosure in the Networking: HTTP component. (CVE-2026-84132) Site isolation issue in the DOM: Push Subscriptions component. (CVE-2026-84133) Other issue in the Profile Backup component. (CVE-2026-84134) Other issue in the DOM: Navigation component. (CVE-2026-84136) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137) Clickjacking issue in the DOM: Events component. (CVE-2026-84139) Site isolation issue in the DOM: Navigation component. (CVE-2026-84140) Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15. (CVE-2026-84143) Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84144) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40. (CVE-2026-84145)

Uninitialized memory in MIME parsing. (CVE-2026-84639) One byte overflow read in mail parser. (CVE-2026-84640) Information disclosure due to malicious IMAP server response. (CVE-2026-84641) Calendar invitation attachments could launch local executables. (CVE-2026-84637) Allowed UNC hostnames for attachments interpreted as a regular expression. (CVE-2026-84642) Sandbox escape in the Remote Settings Client component. (CVE-2026-75874) Privilege escalation in the DOM: Workers component. (CVE-2026-16365) Use-after-free in the JavaScript: GC component. (CVE-2026-84118) Sandbox escape due to use-after-free in the DOM: Navigation component. (CVE-2026-84119) Use-after-free in the Audio/Video component. (CVE-2026-84120) Sandbox escape due to use-after-free in the DOM: Security component. (CVE-2026-84121) Use-after-free in the Audio/Video component. (CVE-2026-84122) Privilege escalation due to use-after-free in the Graphics: WebGPU component. (CVE-2026-84123) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125) Privilege escalation in the DOM: Navigation component. (CVE-2026-16371) Privilege escalation in the Application Update component. (CVE-2026-74952) Site isolation issue in the DOM: Navigation component. (CVE-2026-84129) Information disclosure in the Graphics: WebGPU component. (CVE-2026-84130) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-84131) Information disclosure in the Networking: HTTP component. (CVE-2026-84132) Site isolation issue in the DOM: Push Subscriptions component. (CVE-2026-84133) Other issue in the Profile Backup component. (CVE-2026-84134) Other issue in the DOM: Navigation component. (CVE-2026-84136) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137) Clickjacking issue in the DOM: Events component. (CVE-2026-84139) Site isolation issue in the DOM: Navigation component. (CVE-2026-84140) Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84143) Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2. (CVE-2026-84144) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84145)

These are all security issues fixed in the MozillaFirefox-154.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-153.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-140.15.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Firefox Extended Support Release 153.2.0 ESR MFSA 2026-85 (bsc#1278001):

• CVE-2026-75874 (bmo#2039972) Sandbox escape in the Remote Settings Client component
• CVE-2026-84118 (bmo#2057457) Use-after-free in the JavaScript: GC component
• CVE-2026-84119 (bmo#2057817) Sandbox escape due to use-after-free in the DOM: Navigation component
• CVE-2026-84120 (bmo#2058911) Use-after-free in the Audio/Video component
• CVE-2026-84121 (bmo#2059018) Sandbox escape due to use-after-free in the DOM: Security
• CVE-2026-84122 (bmo#2059965)
• CVE-2026-84123 (bmo#2060047) Privilege escalation due to use-after-free in the Graphics: WebGPU component
• CVE-2026-84124 (bmo#2061110) Use-after-free in the DOM: Core & HTML component
• CVE-2026-84125 (bmo#2063871)
• CVE-2026-74952 (bmo#2021757) Privilege escalation in the Application Update component
• CVE-2026-84129 (bmo#2055028) Site isolation issue in the DOM: Navigation component
• CVE-2026-84130 (bmo#2057834) Information disclosure in the Graphics: WebGPU component
• CVE-2026-84131 (bmo#2060008) Privilege escalation due to invalid pointer in the Graphics
• CVE-2026-84132 (bmo#2063020) Information disclosure in the Networking: HTTP component
• CVE-2026-84133 (bmo#2032388) Site isolation issue in the DOM: Push Subscriptions component
• CVE-2026-84134 (bmo#2044882) Other issue in the Profile Backup component
• CVE-2026-84136 (bmo#2048699) Other issue in the DOM: Navigation component
• CVE-2026-84137 (bmo#2051146) Spoofing issue in the DOM: Core & HTML component
• CVE-2026-84139 (bmo#2060153) Clickjacking issue in the DOM: Events component
• CVE-2026-84140 (bmo#2063780)
• CVE-2026-84141 (bmo#2063994) Integer overflow in the Graphics: ImageLib component
• CVE-2026-84143 (bmo#2048793, bmo#2054631, bmo#2054645, bmo#2054657, bmo#2055007, bmo#2055681, bmo#2057107, bmo#2057108, bmo#2057114, bmo#2058087, bmo#2058088, bmo#2058090, bmo#2058095, bmo#2058101, bmo#2059109, bmo#2059183, bmo#2059185, bmo#2061287, bmo#2061301, bmo#2061325) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
• CVE-2026-84144 (bmo#2054619, bmo#2054620, bmo#2054624, bmo#2054625, bmo#2054691, bmo#2054702, bmo#2054726, bmo#2054775, bmo#2055703, bmo#2058006, bmo#2058013, bmo#2058085, bmo#2058098, bmo#2058627, bmo#2058661, bmo#2059002, bmo#2059127, bmo#2059128, bmo#2059144, bmo#2059180, bmo#2059191, bmo#2059192, bmo#2059199, bmo#2059205, bmo#2061320, bmo#2061430, bmo#2061495, bmo#2061505, bmo#2061521, bmo#2061532, bmo#2061775, bmo#2061799, bmo#2062395, bmo#2062404) Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2
• CVE-2026-84145 (bmo#2054640, bmo#2054650, bmo#2054652, bmo#2055678, bmo#2055693, bmo#2055705, bmo#2058001, bmo#2058051, bmo#2058652, bmo#2058660, bmo#2059027, bmo#2059139, bmo#2061220, bmo#2061242, bmo#2061285, bmo#2061300, bmo#2061316, bmo#2061397, bmo#2062400, bmo#2062419) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

This update for MozillaFirefox fixes the following issues:

Firefox Extended Support Release 153.2.0 ESR MFSA 2026-85 (bsc#1278001):

• CVE-2026-75874 (bmo#2039972) Sandbox escape in the Remote Settings Client component
• CVE-2026-84118 (bmo#2057457) Use-after-free in the JavaScript: GC component
• CVE-2026-84119 (bmo#2057817) Sandbox escape due to use-after-free in the DOM: Navigation component
• CVE-2026-84120 (bmo#2058911) Use-after-free in the Audio/Video component
• CVE-2026-84121 (bmo#2059018) Sandbox escape due to use-after-free in the DOM: Security
• CVE-2026-84122 (bmo#2059965)
• CVE-2026-84123 (bmo#2060047) Privilege escalation due to use-after-free in the Graphics: WebGPU component
• CVE-2026-84124 (bmo#2061110) Use-after-free in the DOM: Core & HTML component
• CVE-2026-84125 (bmo#2063871)
• CVE-2026-74952 (bmo#2021757) Privilege escalation in the Application Update component
• CVE-2026-84129 (bmo#2055028) Site isolation issue in the DOM: Navigation component
• CVE-2026-84130 (bmo#2057834) Information disclosure in the Graphics: WebGPU component
• CVE-2026-84131 (bmo#2060008) Privilege escalation due to invalid pointer in the Graphics
• CVE-2026-84132 (bmo#2063020) Information disclosure in the Networking: HTTP component
• CVE-2026-84133 (bmo#2032388) Site isolation issue in the DOM: Push Subscriptions component
• CVE-2026-84134 (bmo#2044882) Other issue in the Profile Backup component
• CVE-2026-84136 (bmo#2048699) Other issue in the DOM: Navigation component
• CVE-2026-84137 (bmo#2051146) Spoofing issue in the DOM: Core & HTML component
• CVE-2026-84139 (bmo#2060153) Clickjacking issue in the DOM: Events component
• CVE-2026-84140 (bmo#2063780)
• CVE-2026-84141 (bmo#2063994) Integer overflow in the Graphics: ImageLib component
• CVE-2026-84143 (bmo#2048793, bmo#2054631, bmo#2054645, bmo#2054657, bmo#2055007, bmo#2055681, bmo#2057107, bmo#2057108, bmo#2057114, bmo#2058087, bmo#2058088, bmo#2058090, bmo#2058095, bmo#2058101, bmo#2059109, bmo#2059183, bmo#2059185, bmo#2061287, bmo#2061301, bmo#2061325) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
• CVE-2026-84144 (bmo#2054619, bmo#2054620, bmo#2054624, bmo#2054625, bmo#2054691, bmo#2054702, bmo#2054726, bmo#2054775, bmo#2055703, bmo#2058006, bmo#2058013, bmo#2058085, bmo#2058098, bmo#2058627, bmo#2058661, bmo#2059002, bmo#2059127, bmo#2059128, bmo#2059144, bmo#2059180, bmo#2059191, bmo#2059192, bmo#2059199, bmo#2059205, bmo#2061320, bmo#2061430, bmo#2061495, bmo#2061505, bmo#2061521, bmo#2061532, bmo#2061775, bmo#2061799, bmo#2062395, bmo#2062404) Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2
• CVE-2026-84145 (bmo#2054640, bmo#2054650, bmo#2054652, bmo#2055678, bmo#2055693, bmo#2055705, bmo#2058001, bmo#2058051, bmo#2058652, bmo#2058660, bmo#2059027, bmo#2059139, bmo#2061220, bmo#2061242, bmo#2061285, bmo#2061300, bmo#2061316, bmo#2061397, bmo#2062400, bmo#2062419) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 140.14.0 ESR.

• MFSA 2026-74 (bsc#1274867)
  • CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component.
  • CVE-2026-74935: Privilege escalation in the DOM: Networking component.
  • CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-74937: Use-after-free in the JavaScript: GC component.
  • CVE-2026-74938: Mitigation bypass in the JavaScript: GC component.
  • CVE-2026-74939: Privilege escalation in the DOM: Navigation component.
  • CVE-2026-74940: Use-after-free in the Graphics: Text component.
  • CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component.
  • CVE-2026-74942: Privilege escalation in the Remote Settings Client component.
  • CVE-2026-74943: Use-after-free in the Graphics: ImageLib component.
  • CVE-2026-74944: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-74945: Information disclosure in the Graphics: Text component.
  • CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component.
  • CVE-2026-74948: Information disclosure in the Graphics component.
  • CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-74950: Privilege escalation in the Downloads API component.
  • CVE-2026-74951: Clickjacking issue in Firefox for Android.
  • CVE-2026-74952: Privilege escalation in the Application Update component.
  • CVE-2026-74953: Privilege escalation in the Networking: Cookies component.
  • CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component.
  • CVE-2026-74955: Privilege escalation in the Request Handling component.
  • CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component.
  • CVE-2026-74957: Mitigation bypass in the Safe Browsing component.
  • CVE-2026-74958: Information disclosure in the WebRTC component.
  • CVE-2026-74959: Mitigation bypass in the Storage: Cache API component.
  • CVE-2026-74960: Site isolation issue in the WebExtensions component.
  • CVE-2026-74961: Side-channel in the Web Audio component.
  • CVE-2026-74962: Site isolation issue in the Networking: Cookies component.
  • CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component.
  • CVE-2026-74964: Integer overflow in the Graphics component.
  • CVE-2026-74965: Privilege escalation in the Shell Integration component.
  • CVE-2026-74966: Information disclosure in the Form Autofill component.
  • CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component.
  • CVE-2026-74968: Site isolation issue in the Graphics: WebRender component.
  • CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-74970: Site isolation issue in the Graphics component.
  • CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling component.
  • CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component.
  • CVE-2026-74973: Race condition, use-after-free in the Graphics component.
  • CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component.
  • CVE-2026-74975: Spoofing issue in the Downloads component in Firefox for Android.
  • CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component.
  • CVE-2026-74977: Integer overflow in the Graphics component.
  • CVE-2026-74978: Clickjacking issue in the Widget component.
  • CVE-2026-74979: Mitigation bypass in the Add-ons Manager component.
  • CVE-2026-74980: Clickjacking issue in the Downloads component in Firefox for Android.
  • CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component.
  • CVE-2026-74982: Denial-of-service in the Widget component.
  • CVE-2026-74983: Mitigation bypass in the…

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 140.14.0 ESR.

• MFSA 2026-74 (bsc#1274867):
  • CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component.
  • CVE-2026-74935: Privilege escalation in the DOM: Networking component.
  • CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-74937: Use-after-free in the JavaScript: GC component.
  • CVE-2026-74938: Mitigation bypass in the JavaScript: GC component.
  • CVE-2026-74939: Privilege escalation in the DOM: Navigation component.
  • CVE-2026-74940: Use-after-free in the Graphics: Text component.
  • CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component.
  • CVE-2026-74942: Privilege escalation in the Remote Settings Client component.
  • CVE-2026-74943: Use-after-free in the Graphics: ImageLib component.
  • CVE-2026-74944: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-74945: Information disclosure in the Graphics: Text component.
  • CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component.
  • CVE-2026-74948: Information disclosure in the Graphics component.
  • CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-74950: Privilege escalation in the Downloads API component.
  • CVE-2026-74951: Clickjacking issue in Firefox for Android.
  • CVE-2026-74952: Privilege escalation in the Application Update component.
  • CVE-2026-74953: Privilege escalation in the Networking: Cookies component.
  • CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component.
  • CVE-2026-74955: Privilege escalation in the Request Handling component.
  • CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component.
  • CVE-2026-74957: Mitigation bypass in the Safe Browsing component.
  • CVE-2026-74958: Information disclosure in the WebRTC component.
  • CVE-2026-74959: Mitigation bypass in the Storage: Cache API component.
  • CVE-2026-74960: Site isolation issue in the WebExtensions component.
  • CVE-2026-74961: Side-channel in the Web Audio component.
  • CVE-2026-74962: Site isolation issue in the Networking: Cookies component.
  • CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component.
  • CVE-2026-74964: Integer overflow in the Graphics component.
  • CVE-2026-74965: Privilege escalation in the Shell Integration component.
  • CVE-2026-74966: Information disclosure in the Form Autofill component.
  • CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component.
  • CVE-2026-74968: Site isolation issue in the Graphics: WebRender component.
  • CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-74970: Site isolation issue in the Graphics component.
  • CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling component.
  • CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component.
  • CVE-2026-74973: Race condition, use-after-free in the Graphics component.
  • CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component.
  • CVE-2026-74975: Spoofing issue in the Downloads component in Firefox for Android.
  • CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component.
  • CVE-2026-74977: Integer overflow in the Graphics component.
  • CVE-2026-74978: Clickjacking issue in the Widget component.
  • CVE-2026-74979: Mitigation bypass in the Add-ons Manager component.
  • CVE-2026-74980: Clickjacking issue in the Downloads component in Firefox for Android.
  • CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component.
  • CVE-2026-74982: Denial-of-service in the Widget component.
  • CVE-2026-74983: Mitigation bypass in the…

This update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues:

Changes in MozillaFirefox:

This update ships Firefox Extended Support Release 153.2.0 ESR

• Fixed: Various security fixes.

MFSA 2026-85 (bsc#1278001):

• CVE-2026-75874: Sandbox escape in the Remote Settings Client component

• CVE-2026-84118: Use-after-free in the JavaScript: GC component

• CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component

• CVE-2026-84120: Use-after-free in the Audio/Video component

• CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component

• CVE-2026-84122: Use-after-free in the Audio/Video component

• CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics: WebGPU component

• CVE-2026-84124: Use-after-free in the DOM: Core & HTML component

• CVE-2026-84125: Use-after-free in the DOM: Core & HTML component

• CVE-2026-74952: Privilege escalation in the Application Update component

• CVE-2026-84129: Site isolation issue in the DOM: Navigation component

• CVE-2026-84130: Information disclosure in the Graphics: WebGPU component

• CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component

• CVE-2026-84132: Information disclosure in the Networking: HTTP component

• CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component

• CVE-2026-84134: Other issue in the Profile Backup component

• CVE-2026-84136: Other issue in the DOM: Navigation component

• CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component

• CVE-2026-84139: Clickjacking issue in the DOM: Events component

• CVE-2026-84140: Site isolation issue in the DOM: Navigation component

• CVE-2026-84141: Integer overflow in the Graphics: ImageLib component

• CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

• CVE-2026-84144: Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2

• CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

• Fixed: Various security fixes.

  MFSA 2026-77 (bsc#1274867)

  • CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
  • CVE-2026-74935 Privilege escalation in the DOM: Networking component
  • CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
  • CVE-2026-74937 Use-after-free in the JavaScript: GC component
  • CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
  • CVE-2026-74939 Privilege escalation in the DOM: Navigation component
  • CVE-2026-74940 Use-after-free in the Graphics: Text component
  • CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
  • CVE-2026-74942 Privilege escalation in the Remote Settings Client component
  • CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
  • CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
  • CVE-2026-74945 Information disclosure in the Graphics: Text component
  • CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component
  • CVE-2026-74948 Information disclosure in the Graphics component
  • CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component
  • CVE-2026-74950 Privilege escalation in the Downloads API component
  • CVE-2026-74953 Privilege escalation in the Networking: Cookies component
  • CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component
  • CVE-2026-74955 Privilege escalation in the Request Handling component
  • CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers …