CVE-2026-16365

Privilege escalation in the DOM: Workers component

8.8 HighFix available

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.1 points since Jul 22, 2026

What each source reports

CVE List Score used 8.8

Privilege escalation in the DOM: Workers component

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

Record: CVE-2026-16365
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-269, CWE-284
Updated: 2026-11-02

EUVDEUVD-2026-46196 8.8

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

Record: EUVD-2026-46196
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-534q-w7ff-7vh6 9.8

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.

Record: GHSA-534q-w7ff-7vh6
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-269
Updated: 2026-11-02

NVD 8.8

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

Record: CVE-2026-16365
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-269, CWE-284
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-16365 8.8

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

Record: DEBIAN-CVE-2026-16365
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3789 10.0

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.(CVE-2026-16365)

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.(CVE-2026-75874)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84143)

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84145)

Record: OESA-2026-3789
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVOESA-2026-3790 10.0

firefox security update

Security Fix(es):

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.(CVE-2026-16365)

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.(CVE-2026-75874)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Record: OESA-2026-3790
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3791 10.0

firefox security update

Security Fix(es):

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.(CVE-2026-16365)

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.(CVE-2026-75874)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Record: OESA-2026-3791
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3896 10.0

firefox security update

Security Fix(es):

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.(CVE-2026-16365)

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.(CVE-2026-75874)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84131)

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84143)

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84145)

Record: OESA-2026-3896
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:67129 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:67129
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:67133 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:67133
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:68549 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:68549
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:70642 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:70642
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:73130 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:73130
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:73971 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:73971
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76740 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:76740
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76741 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:76741
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76742 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:76742
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76745 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:76745
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76746 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:76746
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76894 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:76894
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76895 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:76895
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:77610 7.5

Red Hat Security Advisory: firefox security update

Record: RHSA-2026:77610
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:77627 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:77627
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:77631 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:77631
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:77632 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:77632
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:80503 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:80503
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:81912 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:81912
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:81913 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:81913
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:82122 7.5

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2026:82122
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:67129 7.5

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:67129
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:67133 7.5

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:67133
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:68549 7.5

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:68549
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:70642 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
firefox: thunderbird: Privilege escalation due to…

Record: RLSA-2026:70642
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:73130 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
firefox: thunderbird: Privilege escalation due to…

Record: RLSA-2026:73130
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:73971 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
firefox: thunderbird: Privilege escalation due to…

Record: RLSA-2026:73971
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-16365 8.8

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

Record: UBUNTU-CVE-2026-16365
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2026:67129 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:67129
Updated: 2026-11-02

OSVALSA-2026:67133 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:67133
Updated: 2026-11-02

OSVALSA-2026:68549 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:68549
Updated: 2026-11-02

OSVALSA-2026:70642 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
firefox:…

Record: ALSA-2026:70642
Updated: 2026-11-02

OSVALSA-2026:73130 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
firefox:…

Record: ALSA-2026:73130
Updated: 2026-11-02

OSVALSA-2026:73971 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)
firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)
firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)
firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)
firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)
firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)
firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)
thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)
thunderbird: One byte overflow read in mail parser (CVE-2026-84640)
firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
firefox:…

Record: ALSA-2026:73971
Updated: 2026-11-02

OSVCLSA-2026-1787115646 No score

thunderbird: Fix of 48 CVEs

update to 153.0.1 ESR (MFSA 2026-71)
drop six patches made obsolete by 153: P02 firefox-gcc-build (fixed upstream), P15 build-system-nss + P16 build-tb-system-nss (both patch third_party/rust/neqo-crypto, a directory 153 no longer has), P19 build-min-lexical, P52 exceptionHandled-for-IO-error-processhandler and P111 av1-else-condition-add (all upstreamed)
Source404 nss-3.126.0-1.el9.src.rpm is a locally rebranded Fedora artifact (md5 1fc9b7b02f848fc99e06d5a8680ea5a3), rebuilt from Fedora rawhide dist-git commit 43cbb021d9886d5abc3d4cb546d022929b9bb1dc (2026-07-29) whose own NVR is nss-3.126.0-1; there is no public nss-3.126.0-1.el9, so the .el9 disttag reflects the build target, not an upstream vendor NVR. The EL9-vs-Fedora patch disposition (Alma c9 carries 29 downstream patches, Fedora 3.126 carries 14) is tracked as a follow-up; NSS stays private to thunderbird either way
P103 mozilla-bmo1504834-part1 loses its gfx/2d/Types.h hunk: that hunk rewrote an #if MOZ_LITTLE_ENDIAN()/#elif MOZ_BIG_ENDIAN() block which 153 replaced with A8R8G8B8_UINT32 = std::endian::native == std::endian::little ? B8G8R8A8 : A8R8G8B8, so it had nothing left to apply; on little-endian that ternary yields B8G8R8A8, which is what the hunk forced. The surviving DrawTargetSkia.cpp kARGBAlphaOffset = 0 is a pre-existing Fedora-inherited override that does NOT match the upstream little-endian value there (that ternary yields 3), but it sits inside #ifdef DEBUG (gfx/2d/DrawTargetSkia.cpp:154-257) alongside VerifyRGBXFormat/VerifyRGBXCorners, so it is compiled out of release builds entirely and has no release impact on any arch
update bundled cbindgen to 0.29.4; Gecko 153 requires >= 0.29.4 and the previous bundle provided 0.27.0
update bundled NSS to 3.126.0 (with NSPR 4.39); Gecko 153 requires nss >= 3.125 and no RHEL/AlmaLinux stream ships one (9.8 still has 3.112). Rebased on the Fedora nss packaging, which tracks 3.126 with a patch set that applies cleanly; the RHEL 3.112 patch set does not survive the jump. NSS stays private to thunderbird under /usr/lib64/thunderbird/bundled as before -- the platform NSS is untouched. Note Source403 (EL8 path) still carries 3.112.
fix the unsorted openssl-backend SOURCES list in comm/third_party/rnp/moz.build; mozbuild requires SOURCES to be appended in sorted order and upstream only exercises the botan backend, so the bug is invisible to them
CVE-2026-16364: Incorrect boundary conditions in the Audio/Video: Playback component
CVE-2026-16365: Privilege escalation in the DOM: Workers component
CVE-2026-16366: Privilege escalation in the DOM: Navigation component
CVE-2026-16367: Sandbox escape due to invalid pointer in the Disability Access APIs component
CVE-2026-16370: Mitigation bypass in the DOM: Networking component
CVE-2026-16372: Privilege escalation in the DOM: Content Processes component
CVE-2026-16376: Denial-of-service in the Graphics: WebGPU component
CVE-2026-16378: Other issue in the DOM: Copy & Paste and Drag & Drop component
CVE-2026-16380: Mitigation bypass in the Networking component
CVE-2026-16382: Mitigation bypass in the DOM: Service Workers component
CVE-2026-16384: Information disclosure due to uninitialized memory in the Graphics: WebGPU component
CVE-2026-16385: Information disclosure due to uninitialized memory in the Graphics: WebGPU component
CVE-2026-16386: Information disclosure due to uninitialized memory in the Graphics: WebGPU component
CVE-2026-16388: Sandbox escape in the DOM: Networking component
CVE-2026-16389: Incorrect boundary conditions, integer overflow in the Libraries component in NSS
CVE-2026-16392: JIT miscompilation in the JavaScript Engine: JIT component
CVE-2026-16393: Incorrect boundary conditions in the Graphics: WebGPU component
CVE-2026-16394: Mitigation bypass in the DOM: Security component
CVE-2026-16395: Integer overflow in the…

Record: CLSA-2026-1787115646
Updated: 2026-11-02

OSVMGASA-2026-0387 No score

Updated firefox & nss packages fix security vulnerabilities

Sandbox escape in the Remote Settings Client component. (CVE-2026-75874) Privilege escalation in the DOM: Workers component. (CVE-2026-16365) Use-after-free in the JavaScript: GC component. (CVE-2026-84118) Sandbox escape due to use-after-free in the DOM: Navigation component. (CVE-2026-84119) Use-after-free in the Audio/Video component. (CVE-2026-84120) Sandbox escape due to use-after-free in the DOM: Security component. (CVE-2026-84121) Use-after-free in the Audio/Video component. (CVE-2026-84122) Privilege escalation due to use-after-free in the Graphics: WebGPU component. (CVE-2026-84123) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125) Privilege escalation in the DOM: Navigation component. (CVE-2026-16371) Privilege escalation in the Application Update component. (CVE-2026-74952) Site isolation issue in the DOM: Navigation component. (CVE-2026-84129) Information disclosure in the Graphics: WebGPU component. (CVE-2026-84130) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-84131) Information disclosure in the Networking: HTTP component. (CVE-2026-84132) Site isolation issue in the DOM: Push Subscriptions component. (CVE-2026-84133) Other issue in the Profile Backup component. (CVE-2026-84134) Other issue in the DOM: Navigation component. (CVE-2026-84136) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137) Clickjacking issue in the DOM: Events component. (CVE-2026-84139) Site isolation issue in the DOM: Navigation component. (CVE-2026-84140) Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15. (CVE-2026-84143) Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84144) Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40. (CVE-2026-84145)

Record: MGASA-2026-0387
Updated: 2026-11-02

OSVMGASA-2026-0388 No score

Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. (CVE-2026-84639) One byte overflow read in mail parser. (CVE-2026-84640) Information disclosure due to malicious IMAP server response. (CVE-2026-84641) Calendar invitation attachments could launch local executables. (CVE-2026-84637) Allowed UNC hostnames for attachments interpreted as a regular expression. (CVE-2026-84642) Sandbox escape in the Remote Settings Client component. (CVE-2026-75874) Privilege escalation in the DOM: Workers component. (CVE-2026-16365) Use-after-free in the JavaScript: GC component. (CVE-2026-84118) Sandbox escape due to use-after-free in the DOM: Navigation component. (CVE-2026-84119) Use-after-free in the Audio/Video component. (CVE-2026-84120) Sandbox escape due to use-after-free in the DOM: Security component. (CVE-2026-84121) Use-after-free in the Audio/Video component. (CVE-2026-84122) Privilege escalation due to use-after-free in the Graphics: WebGPU component. (CVE-2026-84123) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124) Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125) Privilege escalation in the DOM: Navigation component. (CVE-2026-16371) Privilege escalation in the Application Update component. (CVE-2026-74952) Site isolation issue in the DOM: Navigation component. (CVE-2026-84129) Information disclosure in the Graphics: WebGPU component. (CVE-2026-84130) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-84131) Information disclosure in the Networking: HTTP component. (CVE-2026-84132) Site isolation issue in the DOM: Push Subscriptions component. (CVE-2026-84133) Other issue in the Profile Backup component. (CVE-2026-84134) Other issue in the DOM: Navigation component. (CVE-2026-84136) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137) Clickjacking issue in the DOM: Events component. (CVE-2026-84139) Site isolation issue in the DOM: Navigation component. (CVE-2026-84140) Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84143) Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2. (CVE-2026-84144) Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15. (CVE-2026-84145)

Record: MGASA-2026-0388
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11358-1 No score

MozillaFirefox-153.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-153.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11358-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11373-1 No score

firefox-esr-153.0-1.1 on GA media

These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11373-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11678-1 No score

MozillaThunderbird-140.15.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.15.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11678-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21713-1 No score

Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen

This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues:

Changes in MozillaFirefox:

Firefox Extended Support Release 153.1.0 ESR.

Fixed: Various security fixes.

MFSA 2026-77 (bsc#1274867):

CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
CVE-2026-74935 Privilege escalation in the DOM: Networking component
CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
CVE-2026-74937 Use-after-free in the JavaScript: GC component
CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
CVE-2026-74939 Privilege escalation in the DOM: Navigation component
CVE-2026-74940 Use-after-free in the Graphics: Text component
CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
CVE-2026-74942 Privilege escalation in the Remote Settings Client component
CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
CVE-2026-74945 Information disclosure in the Graphics: Text component
CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component
CVE-2026-74948 Information disclosure in the Graphics component
CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component
CVE-2026-74950 Privilege escalation in the Downloads API component
CVE-2026-74953 Privilege escalation in the Networking: Cookies component
CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component
CVE-2026-74955 Privilege escalation in the Request Handling component
CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component
CVE-2026-74957 Mitigation bypass in the Safe Browsing component
CVE-2026-74958 Information disclosure in the WebRTC component
CVE-2026-74959 Mitigation bypass in the Storage: Cache API component
CVE-2026-74960 Site isolation issue in the WebExtensions component
CVE-2026-74961 Side-channel in the Web Audio component
CVE-2026-74962 Site isolation issue in the Networking: Cookies component
CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component
CVE-2026-74964 Integer overflow in the Graphics component
CVE-2026-74965 Privilege escalation in the Shell Integration component
CVE-2026-74966 Information disclosure in the Form Autofill component
CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component
CVE-2026-74968 Site isolation issue in the Graphics: WebRender component
CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component
CVE-2026-74970 Site isolation issue in the Graphics component
CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component
CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions component
CVE-2026-74973 Race condition, use-after-free in the Graphics component
CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component
CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component
CVE-2026-74977 Integer overflow in the Graphics component
CVE-2026-74978 Clickjacking issue in the Widget component
CVE-2026-74979 Mitigation bypass in the Add-ons Manager component
CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component
CVE-2026-74982 Denial-of-service in the Widget component
CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component
CVE-2026-74984 Race condition in the JavaScript Engine component
CVE-2026-74985 Privilege escalation in the Enterprise Policies component
CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component *…

Record: openSUSE-SU-2026:21713-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23411-1 No score

Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen

This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues:

Changes in MozillaFirefox:

Firefox Extended Support Release 153.1.0 ESR.

Fixed: Various security fixes.

MFSA 2026-77 (bsc#1274867):

CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
CVE-2026-74935 Privilege escalation in the DOM: Networking component
CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
CVE-2026-74937 Use-after-free in the JavaScript: GC component
CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
CVE-2026-74939 Privilege escalation in the DOM: Navigation component
CVE-2026-74940 Use-after-free in the Graphics: Text component
CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
CVE-2026-74942 Privilege escalation in the Remote Settings Client component
CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
CVE-2026-74945 Information disclosure in the Graphics: Text component
CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component
CVE-2026-74948 Information disclosure in the Graphics component
CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component
CVE-2026-74950 Privilege escalation in the Downloads API component
CVE-2026-74953 Privilege escalation in the Networking: Cookies component
CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component
CVE-2026-74955 Privilege escalation in the Request Handling component
CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component
CVE-2026-74957 Mitigation bypass in the Safe Browsing component
CVE-2026-74958 Information disclosure in the WebRTC component
CVE-2026-74959 Mitigation bypass in the Storage: Cache API component
CVE-2026-74960 Site isolation issue in the WebExtensions component
CVE-2026-74961 Side-channel in the Web Audio component
CVE-2026-74962 Site isolation issue in the Networking: Cookies component
CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component
CVE-2026-74964 Integer overflow in the Graphics component
CVE-2026-74965 Privilege escalation in the Shell Integration component
CVE-2026-74966 Information disclosure in the Form Autofill component
CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component
CVE-2026-74968 Site isolation issue in the Graphics: WebRender component
CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component
CVE-2026-74970 Site isolation issue in the Graphics component
CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component
CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions component
CVE-2026-74973 Race condition, use-after-free in the Graphics component
CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component
CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component
CVE-2026-74977 Integer overflow in the Graphics component
CVE-2026-74978 Clickjacking issue in the Widget component
CVE-2026-74979 Mitigation bypass in the Add-ons Manager component
CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component
CVE-2026-74982 Denial-of-service in the Widget component
CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component
CVE-2026-74984 Race condition in the JavaScript Engine component
CVE-2026-74985 Privilege escalation in the Enterprise Policies component
CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component *…

Record: SUSE-SU-2026:23411-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23590-1 No score

Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen

This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues:

Changes in MozillaFirefox:

Firefox Extended Support Release 153.1.0 ESR.

Fixed: Various security fixes.

MFSA 2026-77 (bsc#1274867):

CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
CVE-2026-74935 Privilege escalation in the DOM: Networking component
CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
CVE-2026-74937 Use-after-free in the JavaScript: GC component
CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
CVE-2026-74939 Privilege escalation in the DOM: Navigation component
CVE-2026-74940 Use-after-free in the Graphics: Text component
CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
CVE-2026-74942 Privilege escalation in the Remote Settings Client component
CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
CVE-2026-74945 Information disclosure in the Graphics: Text component
CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component
CVE-2026-74948 Information disclosure in the Graphics component
CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component
CVE-2026-74950 Privilege escalation in the Downloads API component
CVE-2026-74953 Privilege escalation in the Networking: Cookies component
CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component
CVE-2026-74955 Privilege escalation in the Request Handling component
CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component
CVE-2026-74957 Mitigation bypass in the Safe Browsing component
CVE-2026-74958 Information disclosure in the WebRTC component
CVE-2026-74959 Mitigation bypass in the Storage: Cache API component
CVE-2026-74960 Site isolation issue in the WebExtensions component
CVE-2026-74961 Side-channel in the Web Audio component
CVE-2026-74962 Site isolation issue in the Networking: Cookies component
CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component
CVE-2026-74964 Integer overflow in the Graphics component
CVE-2026-74965 Privilege escalation in the Shell Integration component
CVE-2026-74966 Information disclosure in the Form Autofill component
CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component
CVE-2026-74968 Site isolation issue in the Graphics: WebRender component
CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component
CVE-2026-74970 Site isolation issue in the Graphics component
CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component
CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions component
CVE-2026-74973 Race condition, use-after-free in the Graphics component
CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component
CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component
CVE-2026-74977 Integer overflow in the Graphics component
CVE-2026-74978 Clickjacking issue in the Widget component
CVE-2026-74979 Mitigation bypass in the Add-ons Manager component
CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component
CVE-2026-74982 Denial-of-service in the Widget component
CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component
CVE-2026-74984 Race condition in the JavaScript Engine component
CVE-2026-74985 Privilege escalation in the Enterprise Policies component
CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component *…

Record: SUSE-SU-2026:23590-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4140-1 No score

Security update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen

This update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues:

Changes in MozillaFirefox:

This update ships Firefox Extended Support Release 153.2.0 ESR

Fixed: Various security fixes.

MFSA 2026-85 (bsc#1278001):

CVE-2026-75874: Sandbox escape in the Remote Settings Client component
CVE-2026-84118: Use-after-free in the JavaScript: GC component
CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component
CVE-2026-84120: Use-after-free in the Audio/Video component
CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component
CVE-2026-84122: Use-after-free in the Audio/Video component
CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics: WebGPU component
CVE-2026-84124: Use-after-free in the DOM: Core & HTML component
CVE-2026-84125: Use-after-free in the DOM: Core & HTML component
CVE-2026-74952: Privilege escalation in the Application Update component
CVE-2026-84129: Site isolation issue in the DOM: Navigation component
CVE-2026-84130: Information disclosure in the Graphics: WebGPU component
CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component
CVE-2026-84132: Information disclosure in the Networking: HTTP component
CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component
CVE-2026-84134: Other issue in the Profile Backup component
CVE-2026-84136: Other issue in the DOM: Navigation component
CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component
CVE-2026-84139: Clickjacking issue in the DOM: Events component
CVE-2026-84140: Site isolation issue in the DOM: Navigation component
CVE-2026-84141: Integer overflow in the Graphics: ImageLib component
CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
CVE-2026-84144: Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2
CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40
Fixed: Various security fixes.

MFSA 2026-77 (bsc#1274867)
- CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
- CVE-2026-74935 Privilege escalation in the DOM: Networking component
- CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-74937 Use-after-free in the JavaScript: GC component
- CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
- CVE-2026-74939 Privilege escalation in the DOM: Navigation component
- CVE-2026-74940 Use-after-free in the Graphics: Text component
- CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
- CVE-2026-74942 Privilege escalation in the Remote Settings Client component
- CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
- CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
- CVE-2026-74945 Information disclosure in the Graphics: Text component
- CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component
- CVE-2026-74948 Information disclosure in the Graphics component
- CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component
- CVE-2026-74950 Privilege escalation in the Downloads API component
- CVE-2026-74953 Privilege escalation in the Networking: Cookies component
- CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component
- CVE-2026-74955 Privilege escalation in the Request Handling component
- CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers …

Record: SUSE-SU-2026:4140-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4156-1 No score

Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen

This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues:

Changes in MozillaFirefox:

Firefox Extended Support Release 153.2.0 ESR

Fixed: Various security fixes.

MFSA 2026-85 (bsc#1278001):
- CVE-2026-75874: Sandbox escape in the Remote Settings Client component
- CVE-2026-84118: Use-after-free in the JavaScript: GC component
- CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component
- CVE-2026-84120: Use-after-free in the Audio/Video component
- CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component
- CVE-2026-84122: Use-after-free in the Audio/Video component
- CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics: WebGPU component
- CVE-2026-84124: Use-after-free in the DOM: Core & HTML component
- CVE-2026-84125: Use-after-free in the DOM: Core & HTML component
- CVE-2026-74952: Privilege escalation in the Application Update component
- CVE-2026-84129: Site isolation issue in the DOM: Navigation component
- CVE-2026-84130: Information disclosure in the Graphics: WebGPU component
- CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component
- CVE-2026-84132: Information disclosure in the Networking: HTTP component
- CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component
- CVE-2026-84134: Other issue in the Profile Backup component
- CVE-2026-84136: Other issue in the DOM: Navigation component
- CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component
- CVE-2026-84139: Clickjacking issue in the DOM: Events component
- CVE-2026-84140: Site isolation issue in the DOM: Navigation component
- CVE-2026-84141: Integer overflow in the Graphics: ImageLib component
- CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
- CVE-2026-84144: Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2
- CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40
- Fixed: Various security fixes.
MFSA 2026-77 (bsc#1274867):
- CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
- CVE-2026-74935: Privilege escalation in the DOM: Networking component
- CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-74937: Use-after-free in the JavaScript: GC component
- CVE-2026-74938: Mitigation bypass in the JavaScript: GC component
- CVE-2026-74939: Privilege escalation in the DOM: Navigation component
- CVE-2026-74940: Use-after-free in the Graphics: Text component
- CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component
- CVE-2026-74942: Privilege escalation in the Remote Settings Client component
- CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
- CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
- CVE-2026-74945: Information disclosure in the Graphics: Text component
- CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component
- CVE-2026-74948: Information disclosure in the Graphics component
- CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
- CVE-2026-74950: Privilege escalation in the Downloads API component
- CVE-2026-74953: Privilege escalation in the Networking: Cookies component
- CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component
- CVE-2026-74955: Privilege escalation in the Request Handling component
- CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component
- CVE-2026-74957: Mitigation bypass in the Safe Browsing…

Record: SUSE-SU-2026:4156-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`firefox` AlmaLinux:10 From an advisory covering 10 CVEs	before 140.15.0-1.el10_2	140.15.0-1.el10_2
`firefox` AlmaLinux:9 From an advisory covering 10 CVEs	before 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1
`firefox-x11` AlmaLinux:9 From an advisory covering 10 CVEs	before 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1
`firefox` AlmaLinux:8 From an advisory covering 10 CVEs	before 140.15.0-1.el8_10.alma.1	140.15.0-1.el8_10.alma.1
`thunderbird` AlmaLinux:9 From an advisory covering 44 CVEs	before 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1
`thunderbird` AlmaLinux:10 From an advisory covering 44 CVEs	before 140.16.0-1.el10_2.alma.1	140.16.0-1.el10_2.alma.1
`thunderbird` AlmaLinux:8 From an advisory covering 44 CVEs	before 140.16.0-1.el8_10.alma.1	140.16.0-1.el8_10.alma.1
`thunderbird` TuxCare:AlmaLinux:9.2 From an advisory covering 31 CVEs	before 153.0.1-1.el9_2.alma.1.tuxcare.els1	153.0.1-1.el9_2.alma.1.tuxcare.els1
`firefox-esr` Debian:12	before 140.15.0esr-1~deb12u1, plus listed versions 102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1 Show 45 moreShow less 102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1	140.15.0esr-1~deb12u1
`firefox-esr` Debian:13	before 140.15.0esr-1~deb13u1, plus listed versions 128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1 Show 45 moreShow less 140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1~deb12u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1140.4.0esr-1~deb13u1	140.15.0esr-1~deb13u1

Show 197 moreShow less

Affected packages
Package	Affected	Fixed
`firefox-esr` Debian:14	before 140.15.0esr-1, plus listed versions 128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1 Show 45 moreShow less 140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1~deb12u1140.15.0esr-1~deb13u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1	140.15.0esr-1
`thunderbird` Debian:12	before 1:140.15.0esr-1~deb12u1, plus listed versions 1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1 Show 45 moreShow less 1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1	1:140.15.0esr-1~deb12u1
`thunderbird` Debian:13	before 1:140.15.0esr-1~deb13u1, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less 1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u1	1:140.15.0esr-1~deb13u1
`thunderbird` Debian:14	before 1:153.2.0esr-1, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less 1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1	1:153.2.0esr-1
`firefox-l10n` Mageia:10 From an advisory covering 26 CVEs	before 153.2.0-1.mga10	153.2.0-1.mga10
`firefox` Mageia:10 From an advisory covering 26 CVEs	before 153.2.0-1.mga10	153.2.0-1.mga10
`nss` Mageia:10 From an advisory covering 26 CVEs	before 3.128.0-1.mga10	3.128.0-1.mga10
`firefox-l10n` Mageia:9 From an advisory covering 26 CVEs	before 140.15.0-1.mga9	140.15.0-1.mga9
`firefox` Mageia:9 From an advisory covering 26 CVEs	before 140.15.0-1.mga9	140.15.0-1.mga9
`nss` Mageia:9 From an advisory covering 26 CVEs	before 3.128.0-1.mga9	3.128.0-1.mga9
`thunderbird` Mageia:10 From an advisory covering 31 CVEs	before 153.2.0-1.mga10	153.2.0-1.mga10
`thunderbird-l10n` Mageia:10 From an advisory covering 31 CVEs	before 153.2.0-1.mga10	153.2.0-1.mga10
`thunderbird` Mageia:9 From an advisory covering 31 CVEs	before 140.15.0-1.mga9	140.15.0-1.mga9
`thunderbird-l10n` Mageia:9 From an advisory covering 31 CVEs	before 140.15.0-1.mga9	140.15.0-1.mga9
`firefox` openEuler:24.03-LTS-SP1 From an advisory covering 10 CVEs	before 140.15.0-1.oe2403sp1	140.15.0-1.oe2403sp1
`firefox` openEuler:24.03-LTS-SP4 From an advisory covering 10 CVEs	before 140.15.0-1.oe2403sp4	140.15.0-1.oe2403sp4
`firefox` openEuler:22.03-LTS-SP4 From an advisory covering 10 CVEs	before 140.14.0-1.oe2203sp4	140.14.0-1.oe2203sp4
`firefox` openEuler:24.03-LTS-SP3 From an advisory covering 10 CVEs	before 140.16.0-1.oe2403sp3	140.16.0-1.oe2403sp3
`firefox` Red Hat:enterprise_linux:10.2 From an advisory covering 10 CVEs	before 0:140.15.0-1.el10_2	0:140.15.0-1.el10_2
`firefox-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 10 CVEs	before 0:140.15.0-1.el10_2	0:140.15.0-1.el10_2
`firefox-debugsource` Red Hat:enterprise_linux:10.2 From an advisory covering 10 CVEs	before 0:140.15.0-1.el10_2	0:140.15.0-1.el10_2
`firefox` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_8	0:140.15.0-1.el9_8
`firefox-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_8	0:140.15.0-1.el9_8
`firefox-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_8	0:140.15.0-1.el9_8
`firefox-x11` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_8	0:140.15.0-1.el9_8
`firefox` Red Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_10	0:140.15.0-1.el8_10
`firefox-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_10	0:140.15.0-1.el8_10
`firefox-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_10	0:140.15.0-1.el8_10
`thunderbird` Red Hat:enterprise_linux:9::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el9_8	0:140.16.0-1.el9_8
`thunderbird-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el9_8	0:140.16.0-1.el9_8
`thunderbird-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el9_8	0:140.16.0-1.el9_8
`thunderbird` Red Hat:enterprise_linux:10.2 From an advisory covering 44 CVEs	before 0:140.16.0-1.el10_2	0:140.16.0-1.el10_2
`thunderbird-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 44 CVEs	before 0:140.16.0-1.el10_2	0:140.16.0-1.el10_2
`thunderbird-debugsource` Red Hat:enterprise_linux:10.2 From an advisory covering 44 CVEs	before 0:140.16.0-1.el10_2	0:140.16.0-1.el10_2
`thunderbird` Red Hat:enterprise_linux:8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_10	0:140.16.0-1.el8_10
`thunderbird-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_10	0:140.16.0-1.el8_10
`thunderbird-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_10	0:140.16.0-1.el8_10
`firefox` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_4	0:140.15.0-1.el9_4
`firefox-debuginfo` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_4	0:140.15.0-1.el9_4
`firefox-debugsource` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_4	0:140.15.0-1.el9_4
`firefox-x11` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_4	0:140.15.0-1.el9_4
`firefox` Red Hat:rhel_els:7 From an advisory covering 10 CVEs	before 0:140.15.0-1.el7_9	0:140.15.0-1.el7_9
`firefox-debuginfo` Red Hat:rhel_els:7 From an advisory covering 10 CVEs	before 0:140.15.0-1.el7_9	0:140.15.0-1.el7_9
`firefox` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_2	0:140.15.0-1.el9_2
`firefox-debuginfo` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_2	0:140.15.0-1.el9_2
`firefox-debugsource` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_2	0:140.15.0-1.el9_2
`firefox-x11` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_2	0:140.15.0-1.el9_2
`firefox` Red Hat:rhel_aus:8.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_6	0:140.15.0-1.el8_6
`firefox-debuginfo` Red Hat:rhel_aus:8.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_6	0:140.15.0-1.el8_6
`firefox-debugsource` Red Hat:rhel_aus:8.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_6	0:140.15.0-1.el8_6
`firefox` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_6	0:140.15.0-1.el8_6
`firefox-debuginfo` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_6	0:140.15.0-1.el8_6
`firefox-debugsource` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_6	0:140.15.0-1.el8_6
`firefox` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_8	0:140.15.0-1.el8_8
`firefox-debuginfo` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_8	0:140.15.0-1.el8_8
`firefox-debugsource` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_8	0:140.15.0-1.el8_8
`firefox` Red Hat:rhel_tus:8.8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_8	0:140.15.0-1.el8_8
`firefox-debuginfo` Red Hat:rhel_tus:8.8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_8	0:140.15.0-1.el8_8
`firefox-debugsource` Red Hat:rhel_tus:8.8::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_8	0:140.15.0-1.el8_8
`firefox` Red Hat:rhel_aus:8.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_4	0:140.15.0-1.el8_4
`firefox-debuginfo` Red Hat:rhel_aus:8.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_4	0:140.15.0-1.el8_4
`firefox-debugsource` Red Hat:rhel_aus:8.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_4	0:140.15.0-1.el8_4
`firefox` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_4	0:140.15.0-1.el8_4
`firefox-debuginfo` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_4	0:140.15.0-1.el8_4
`firefox-debugsource` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_4	0:140.15.0-1.el8_4
`firefox` Red Hat:rhel_eus:9.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_6	0:140.15.0-1.el9_6
`firefox-debuginfo` Red Hat:rhel_eus:9.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_6	0:140.15.0-1.el9_6
`firefox-debugsource` Red Hat:rhel_eus:9.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_6	0:140.15.0-1.el9_6
`firefox-x11` Red Hat:rhel_eus:9.6::appstream From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_6	0:140.15.0-1.el9_6
`firefox` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 10 CVEs	before 0:140.15.0-1.el10_0	0:140.15.0-1.el10_0
`firefox-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 10 CVEs	before 0:140.15.0-1.el10_0	0:140.15.0-1.el10_0
`firefox-debugsource` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 10 CVEs	before 0:140.15.0-1.el10_0	0:140.15.0-1.el10_0
`thunderbird` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_4	0:140.15.0-1.el9_4
`thunderbird-debuginfo` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_4	0:140.15.0-1.el9_4
`thunderbird-debugsource` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_4	0:140.15.0-1.el9_4
`thunderbird` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 13 CVEs	before 0:140.15.0-1.el10_0	0:140.15.0-1.el10_0
`thunderbird-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 13 CVEs	before 0:140.15.0-1.el10_0	0:140.15.0-1.el10_0
`thunderbird-debugsource` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 13 CVEs	before 0:140.15.0-1.el10_0	0:140.15.0-1.el10_0
`thunderbird` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_2	0:140.15.0-1.el9_2
`thunderbird-debuginfo` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_2	0:140.15.0-1.el9_2
`thunderbird-debugsource` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_2	0:140.15.0-1.el9_2
`thunderbird` Red Hat:rhel_eus:9.6::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_6	0:140.15.0-1.el9_6
`thunderbird-debuginfo` Red Hat:rhel_eus:9.6::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_6	0:140.15.0-1.el9_6
`thunderbird-debugsource` Red Hat:rhel_eus:9.6::appstream From an advisory covering 13 CVEs	before 0:140.15.0-1.el9_6	0:140.15.0-1.el9_6
`thunderbird` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_8	0:140.16.0-1.el8_8
`thunderbird-debuginfo` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_8	0:140.16.0-1.el8_8
`thunderbird-debugsource` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_8	0:140.16.0-1.el8_8
`thunderbird` Red Hat:rhel_tus:8.8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_8	0:140.16.0-1.el8_8
`thunderbird-debuginfo` Red Hat:rhel_tus:8.8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_8	0:140.16.0-1.el8_8
`thunderbird-debugsource` Red Hat:rhel_tus:8.8::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_8	0:140.16.0-1.el8_8
`thunderbird` Red Hat:rhel_aus:8.6::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_6	0:140.16.0-1.el8_6
`thunderbird-debuginfo` Red Hat:rhel_aus:8.6::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_6	0:140.16.0-1.el8_6
`thunderbird-debugsource` Red Hat:rhel_aus:8.6::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_6	0:140.16.0-1.el8_6
`thunderbird` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_6	0:140.16.0-1.el8_6
`thunderbird-debuginfo` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_6	0:140.16.0-1.el8_6
`thunderbird-debugsource` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_6	0:140.16.0-1.el8_6
`thunderbird` Red Hat:rhel_aus:8.4::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_4	0:140.16.0-1.el8_4
`thunderbird-debuginfo` Red Hat:rhel_aus:8.4::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_4	0:140.16.0-1.el8_4
`thunderbird-debugsource` Red Hat:rhel_aus:8.4::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_4	0:140.16.0-1.el8_4
`thunderbird` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_4	0:140.16.0-1.el8_4
`thunderbird-debuginfo` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_4	0:140.16.0-1.el8_4
`thunderbird-debugsource` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_4	0:140.16.0-1.el8_4
`firefox` Rocky Linux:10 From an advisory covering 10 CVEs	before 0:140.15.0-1.el10_2	0:140.15.0-1.el10_2
`firefox` Rocky Linux:9 From an advisory covering 10 CVEs	before 0:140.15.0-1.el9_8	0:140.15.0-1.el9_8
`firefox` Rocky Linux:8 From an advisory covering 10 CVEs	before 0:140.15.0-1.el8_10	0:140.15.0-1.el8_10
`thunderbird` Rocky Linux:9 From an advisory covering 44 CVEs	before 0:140.16.0-1.el9_8	0:140.16.0-1.el9_8
`thunderbird` Rocky Linux:10 From an advisory covering 44 CVEs	before 0:140.16.0-1.el10_2	0:140.16.0-1.el10_2
`thunderbird` Rocky Linux:8 From an advisory covering 44 CVEs	before 0:140.16.0-1.el8_10	0:140.16.0-1.el8_10
`mozilla-nspr` SUSE:Linux Micro 6.2 From an advisory covering 115 CVEs	before 4.39-160000.1.1	4.39-160000.1.1
`mozilla-nss` SUSE:Linux Micro 6.2 From an advisory covering 115 CVEs	before 3.125-160000.1.1	3.125-160000.1.1
`MozillaFirefox` SUSE:Linux Enterprise Server 16.0 From an advisory covering 115 CVEs	before 153.1.0-160000.1.1	153.1.0-160000.1.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server 16.0 From an advisory covering 115 CVEs	before 153-160000.1.1	153-160000.1.1
`mozilla-nspr` SUSE:Linux Enterprise Server 16.0 From an advisory covering 115 CVEs	before 4.39-160000.1.1	4.39-160000.1.1
`mozilla-nss` SUSE:Linux Enterprise Server 16.0 From an advisory covering 115 CVEs	before 3.125-160000.1.1	3.125-160000.1.1
`rust-cbindgen` SUSE:Linux Enterprise Server 16.0 From an advisory covering 115 CVEs	before 0.29.4+git0-160000.1.1	0.29.4+git0-160000.1.1
`MozillaFirefox` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 115 CVEs	before 153.1.0-160000.1.1	153.1.0-160000.1.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 115 CVEs	before 153-160000.1.1	153-160000.1.1
`mozilla-nspr` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 115 CVEs	before 4.39-160000.1.1	4.39-160000.1.1
`mozilla-nss` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 115 CVEs	before 3.125-160000.1.1	3.125-160000.1.1
`rust-cbindgen` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 115 CVEs	before 0.29.4+git0-160000.1.1	0.29.4+git0-160000.1.1
`MozillaFirefox` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 139 CVEs	before 153.2.0-118.5.4	153.2.0-118.5.4
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 139 CVEs	before 153-41.3.8	153-41.3.8
`mozilla-nspr` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 139 CVEs	before 4.39-19.39.1	4.39-19.39.1
`mozilla-nss` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 139 CVEs	before 3.125-58.147.1	3.125-58.147.1
`MozillaFirefox` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 139 CVEs	before 153.2.0-118.5.4	153.2.0-118.5.4
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 139 CVEs	before 153-41.3.8	153-41.3.8
`mozilla-nspr` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 139 CVEs	before 4.39-19.39.1	4.39-19.39.1
`mozilla-nss` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 139 CVEs	before 3.125-58.147.1	3.125-58.147.1
`mozilla-nspr` SUSE:Linux Enterprise Micro 5.3 From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Micro 5.3 From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`mozilla-nspr` SUSE:Linux Enterprise Micro 5.4 From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Micro 5.4 From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`mozilla-nspr` SUSE:Linux Enterprise Micro 5.5 From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Micro 5.5 From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`mozilla-nspr` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`MozillaFirefox` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaFirefox` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 139 CVEs	before 153.2.0-150400.157.5.1	153.2.0-150400.157.5.1
`MozillaFirefox-branding-SLE` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 139 CVEs	before 153-150400.14.3.1	153-150400.14.3.1
`mozilla-nspr` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 139 CVEs	before 4.39-150400.12.3.1	4.39-150400.12.3.1
`mozilla-nss` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 139 CVEs	before 3.125-150400.3.74.1	3.125-150400.3.74.1
`MozillaThunderbird` SUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 143 CVEs	before 153.2.0-150400.13.3.1	153.2.0-150400.13.3.1
`MozillaThunderbird` SUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 143 CVEs	before 153.2.0-150400.13.3.1	153.2.0-150400.13.3.1
`mozjs52` Ubuntu:18.04:LTS	All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1	None known
`mozjs38` Ubuntu:18.04:LTS	All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4	None known
`mozjs68` Ubuntu:20.04:LTS	All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1	None known
`mozjs52` Ubuntu:20.04:LTS	All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3	None known
`mozjs102` Ubuntu:22.04:LTS	All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1	None known
`mozjs78` Ubuntu:22.04:LTS	All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1	None known
`mozjs91` Ubuntu:22.04:LTS	All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1	None known
`thunderbird` Ubuntu:22.04:LTS	All versions, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 34 moreShow less 1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1	None known
`mozjs102` Ubuntu:24.04:LTS	All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2	None known
`mozjs115` Ubuntu:24.04:LTS	All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less 115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1	None known
`MozillaFirefox` openSUSE:Tumbleweed From an advisory covering 63 CVEs	before 153.0-1.1	153.0-1.1
`firefox-esr` openSUSE:Tumbleweed From an advisory covering 228 CVEs	before 153.0-1.1	153.0-1.1
`MozillaThunderbird` openSUSE:Tumbleweed From an advisory covering 13 CVEs	before 140.15.0-1.1	140.15.0-1.1
`MozillaFirefox` openSUSE:Leap 16.0 From an advisory covering 115 CVEs	before 153.1.0-160000.1.2	153.1.0-160000.1.2
`mozilla-nspr` openSUSE:Leap 16.0 From an advisory covering 115 CVEs	before 4.39-160000.1.1	4.39-160000.1.1
`mozilla-nss` openSUSE:Leap 16.0 From an advisory covering 115 CVEs	before 3.125-160000.1.1	3.125-160000.1.1
`rust-cbindgen` openSUSE:Leap 16.0 From an advisory covering 115 CVEs	before 0.29.4+git0-160000.1.1	0.29.4+git0-160000.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16365 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in firefox-esr 140.15.0esr-1~deb12u1.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 453 versions, 514 references and the rest of 12 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 1 source record.