{"id":"CVE-2026-117882","aliases":["DEBIAN-CVE-2026-117882","EUVD-2026-111053","GHSA-2j5p-pq5g-pxh9","MGASA-2026-0582","MGASA-2026-0583","OESA-2026-4675","OESA-2026-4761","SUSE-SU-2026:4928-1","SUSE-SU-2026:5145-1","UBUNTU-CVE-2026-117882","openSUSE-SU-2026:12319-1","openSUSE-SU-2026:12339-1"],"status":"published","title":"Use-after-free in the Layout component","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00274,"percentile":0.19957,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-10-27T14:05:10Z","modified":"2026-11-11T12:45:06Z","fixes":[{"ecosystem":"Debian:12","package":"firefox-esr","fixed_in":["153.6.0esr-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"firefox-esr","fixed_in":["153.6.0esr-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:153.6.0esr-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:153.6.0esr-1~deb13u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0esr-1~deb12u2"}]}],"versions":["102.11.0esr-1","102.12.0esr-1","102.12.0esr-1~deb10u1","102.12.0esr-1~deb11u1","102.12.0esr-1~deb12u1","102.13.0esr-1","102.13.0esr-1~deb10u1","102.13.0esr-1~deb11u1","102.13.0esr-1~deb12u1","102.14.0esr-1~deb10u1","102.14.0esr-1~deb11u1","102.14.0esr-1~deb12u1","102.15.0esr-1~deb10u1","102.15.0esr-1~deb11u1","102.15.0esr-1~deb12u1","102.15.1esr-1~deb10u1","102.15.1esr-1~deb11u1","102.15.1esr-1~deb12u1","115.0.2esr-1","115.1.0esr-1","115.10.0esr-1","115.10.0esr-1~deb10u1","115.10.0esr-1~deb11u1","115.10.0esr-1~deb12u1","115.11.0esr-1","115.11.0esr-1~deb10u1","115.11.0esr-1~deb11u1","115.11.0esr-1~deb12u1","115.12.0esr-1","115.12.0esr-1~deb10u1","115.12.0esr-1~deb11u1","115.12.0esr-1~deb12u1","115.13.0esr-1","115.13.0esr-1~deb11u1","115.13.0esr-1~deb12u1","115.13.0esr-2","115.14.0esr-1","115.14.0esr-1~deb11u1","115.14.0esr-1~deb12u1","115.15.0esr-1","115.15.0esr-1~deb11u1","115.15.0esr-1~deb12u1","115.2.0esr-1","115.2.1esr-1","115.3.0esr-1","115.3.0esr-1~deb10u1","115.3.0esr-1~deb11u1","115.3.0esr-1~deb12u1","115.3.1esr-1~deb10u1","115.3.1esr-1~deb11u1","115.4.0esr-1","115.4.0esr-1~deb10u1","115.4.0esr-1~deb11u1","115.4.0esr-1~deb12u1","115.5.0esr-1","115.5.0esr-1~deb10u1","115.5.0esr-1~deb11u1","115.5.0esr-1~deb12u1","115.6.0esr-1","115.6.0esr-1~deb10u1","115.6.0esr-1~deb11u1","115.6.0esr-1~deb12u1","115.7.0esr-1","115.7.0esr-1~deb10u1","115.7.0esr-1~deb11u1","115.7.0esr-1~deb12u1","115.8.0esr-1","115.8.0esr-1~deb10u1","115.8.0esr-1~deb11u1","115.8.0esr-1~deb12u1","115.9.0esr-1","115.9.0esr-1~deb11u1","115.9.0esr-1~deb12u1","115.9.0esr-2","115.9.1esr-1","115.9.1esr-1~deb10u1","115.9.1esr-1~deb11u1","115.9.1esr-1~deb12u1","128.10.0esr-1","128.10.0esr-1~deb12u1","128.10.1esr-1","128.10.1esr-1~deb11u1","128.10.1esr-1~deb12u1","128.11.0esr-1","128.11.0esr-1~deb11u1","128.11.0esr-1~deb12u1","128.12.0esr-1","128.12.0esr-1~deb11u1","128.12.0esr-1~deb12u1","128.13.0esr-1","128.13.0esr-1~deb11u1","128.13.0esr-1~deb12u1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","128.3.0esr-1","128.3.0esr-1~deb11u1","128.3.0esr-1~deb11u2","128.3.0esr-1~deb12u1","128.3.0esr-2","128.3.1esr-1","128.3.1esr-1~deb11u1","128.3.1esr-1~deb12u1","128.3.1esr-2","128.4.0esr-1","128.4.0esr-1~deb11u1","128.4.0esr-1~deb12u1","128.5.0esr-1","128.5.0esr-1~deb11u1","128.5.0esr-1~deb12u1","128.5.1esr-1","128.6.0esr-1","128.6.0esr-1~deb11u1","128.6.0esr-1~deb11u2","128.6.0esr-1~deb11u3","128.6.0esr-1~deb12u1","128.6.0esr-2","128.6.0esr-3","128.6.0esr-4","128.7.0esr-1","128.7.0esr-1~deb11u1","128.7.0esr-1~deb12u1","128.8.0esr-1","128.8.0esr-1~deb11u1","128.8.0esr-1~deb12u1","128.9.0esr-1","128.9.0esr-1~deb11u1","128.9.0esr-1~deb12u1","128.9.0esr-2","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.13.0esr-1~deb13u1","140.13.0esr-2","140.14.0esr-1~deb11u1","140.14.0esr-1~deb12u1","140.14.0esr-1~deb13u1","140.14.0esr-2","140.15.0esr-1","140.15.0esr-1~deb12u1","140.15.0esr-1~deb13u1","140.16.0esr-1","140.16.0esr-1~deb12u1","140.16.0esr-1~deb13u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1","153.1.0esr-1","153.2.0esr-1","153.3.0esr-1","153.4.0esr-1","153.4.0esr-1~deb12u1","153.4.0esr-1~deb13u1","153.5.0esr-1","153.5.0esr-1~deb12u1","153.5.0esr-1~deb13u1","153.5.1esr-1","153.5.1esr-1~deb12u1","153.5.1esr-1~deb13u1","153.6.0esr-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0esr-1~deb13u1"}]}],"versions":["128.13.0esr-1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.13.0esr-1~deb13u1","140.13.0esr-2","140.14.0esr-1~deb11u1","140.14.0esr-1~deb12u1","140.14.0esr-1~deb13u1","140.14.0esr-2","140.15.0esr-1","140.15.0esr-1~deb12u1","140.15.0esr-1~deb13u1","140.16.0esr-1","140.16.0esr-1~deb12u1","140.16.0esr-1~deb13u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1","153.1.0esr-1","153.2.0esr-1","153.3.0esr-1","153.4.0esr-1","153.4.0esr-1~deb12u1","153.4.0esr-1~deb13u1","153.5.0esr-1","153.5.0esr-1~deb12u1","153.5.0esr-1~deb13u1","153.5.1esr-1","153.5.1esr-1~deb12u1","153.5.1esr-1~deb13u1","153.6.0esr-1~deb12u1","153.6.0esr-1~deb12u2"]},{"source":"osv","ecosystem":"Debian:14","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["128.13.0esr-1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.13.0esr-1~deb13u1","140.13.0esr-2","140.14.0esr-1~deb11u1","140.14.0esr-1~deb12u1","140.14.0esr-1~deb13u1","140.14.0esr-2","140.15.0esr-1","140.15.0esr-1~deb12u1","140.15.0esr-1~deb13u1","140.16.0esr-1","140.16.0esr-1~deb12u1","140.16.0esr-1~deb13u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1","153.1.0esr-1","153.2.0esr-1","153.3.0esr-1","153.4.0esr-1","153.4.0esr-1~deb12u1","153.4.0esr-1~deb13u1","153.5.0esr-1","153.5.0esr-1~deb12u1","153.5.0esr-1~deb13u1","153.5.1esr-1","153.5.1esr-1~deb12u1","153.5.1esr-1~deb13u1","153.6.0esr-1","153.6.0esr-1~deb12u1","153.6.0esr-1~deb12u2","153.6.0esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.6.0esr-1~deb12u2"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1","1:102.13.1-1~deb12u1","1:102.14.0-1~deb10u1","1:102.14.0-1~deb11u1","1:102.14.0-1~deb12u1","1:102.15.0-1~deb10u1","1:102.15.0-1~deb11u1","1:102.15.0-1~deb12u1","1:102.15.1-1~deb10u1","1:102.15.1-1~deb11u1","1:102.15.1-1~deb12u1","1:103.0~b5-1","1:104.0~b2-1","1:110.0~b4-1","1:112.0~b1-1","1:113.0~b3-1","1:114.0~b2-1","1:115.0-1","1:115.0.1-1","1:115.0.1-2","1:115.0~b4-1","1:115.0~b6-1","1:115.1.0-1","1:115.1.1-1","1:115.10.1-1","1:115.10.1-1~deb10u1","1:115.10.1-1~deb11u1","1:115.10.1-1~deb12u1","1:115.11.0-1","1:115.11.0-1~deb10u1","1:115.11.0-1~deb11u1","1:115.11.0-1~deb12u1","1:115.12.0-1","1:115.12.0-1~deb10u1","1:115.12.0-1~deb11u1","1:115.12.0-1~deb12u1","1:115.13.0-1","1:115.13.0-1~deb11u1","1:115.13.0-1~deb12u1","1:115.14.0-1~deb11u1","1:115.14.0-1~deb12u1","1:115.15.0-1~deb11u1","1:115.15.0-1~deb12u1","1:115.16.0esr-1~deb11u1","1:115.16.0esr-1~deb12u1","1:115.2.0-1","1:115.2.2-1","1:115.3.0-1","1:115.3.0-1~deb12u1","1:115.3.1-1","1:115.3.1-1~deb10u1","1:115.3.1-1~deb11u1","1:115.3.1-1~deb12u1","1:115.4.1-1","1:115.4.1-1~deb10u1","1:115.4.1-1~deb11u1","1:115.4.1-1~deb12u1","1:115.5.0-1","1:115.5.0-1~deb10u1","1:115.5.0-1~deb11u1","1:115.5.0-1~deb12u1","1:115.5.1-1","1:115.5.2-1","1:115.6.0-1","1:115.6.0-1~deb10u1","1:115.6.0-1~deb11u1","1:115.6.0-1~deb12u1","1:115.7.0-1","1:115.7.0-1~deb10u1","1:115.7.0-1~deb11u1","1:115.7.0-1~deb12u1","1:115.8.0-1","1:115.8.0-1~deb10u1","1:115.8.0-1~deb11u1","1:115.8.0-1~deb12u1","1:115.8.1-1","1:115.9.0-1","1:115.9.0-1~deb10u1","1:115.9.0-1~deb11u1","1:115.9.0-1~deb12u1","1:116.0~b7-1","1:117.0~b5-1","1:120.0~b1-1","1:121.0~b3-1","1:122.0~b2-1","1:124.0~b5-1","1:125.0~b3-1","1:127.0~b5-1","1:128.0esr-1","1:128.0~b5-1","1:128.1.0esr-1","1:128.1.1esr-1","1:128.10.0esr-1","1:128.10.0esr-1~deb11u1","1:128.10.0esr-1~deb12u1","1:128.10.1esr-1","1:128.10.1esr-1~deb11u1","1:128.10.1esr-1~deb12u1","1:128.11.0esr-1","1:128.11.0esr-1~deb11u1","1:128.11.0esr-1~deb12u1","1:128.12.0esr-1","1:128.12.0esr-1~deb11u1","1:128.12.0esr-1~deb12u1","1:128.13.0esr-1","1:128.13.0esr-1~deb11u1","1:128.13.0esr-1~deb12u1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:128.2.0esr-1","1:128.2.1esr-1","1:128.2.3esr-1","1:128.3.0esr-1","1:128.3.2esr-1","1:128.4.0esr-1","1:128.4.0esr-1~deb11u1","1:128.4.0esr-1~deb12u1","1:128.4.2esr-1","1:128.4.3esr-1","1:128.4.3esr-1~deb11u1","1:128.4.3esr-1~deb12u1","1:128.5.0esr-1","1:128.5.0esr-1~deb11u1","1:128.5.0esr-1~deb12u1","1:128.5.2esr-1","1:128.6.0esr-1","1:128.6.0esr-1~deb11u1","1:128.6.0esr-1~deb12u1","1:128.7.0esr-1","1:128.7.0esr-1~deb11u1","1:128.7.0esr-1~deb12u1","1:128.8.0esr-1","1:128.8.0esr-1~deb11u1","1:128.8.0esr-1~deb12u1","1:128.9.0esr-1","1:128.9.0esr-1~deb11u1","1:128.9.0esr-1~deb12u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:153.6.0esr-1~deb13u1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1~deb12u1","1:153.6.0esr-1~deb12u2"]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1","1:153.6.0esr-1~deb12u1","1:153.6.0esr-1~deb12u2","1:153.6.0esr-1~deb13u1","1:155.0.1-1","1:155.0.1-2","1:157.0-1","1:159.0-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":145},{"source":"osv","ecosystem":"Mageia:10","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":145},{"source":"osv","ecosystem":"Mageia:10","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.132.0-1.mga10"}]}],"bundled":145},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":154},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":154},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.oe2403sp3"}]}],"bundled":144},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.oe2403sp4"}]}],"bundled":144},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-118.19.2"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-118.19.2"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0-0ubuntu0.22.04.1","102.12.0-0ubuntu0.22.04.1","102.13.0-0ubuntu0.22.04.1","102.15.1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.15.1-1","102.15.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["115.3.0-0ubuntu1","115.4.0-2","115.5.0-1","115.6.0-1","115.7.0-4","115.8.0-1","115.9.0-1","115.9.0-1build1","115.10.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.1"}]}],"bundled":144},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.1"}]}],"bundled":153}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2076268","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-118/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-119/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-120/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-121/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-122/","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117882","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-118"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-119"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-120"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-121"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-122"},{"url":"https://github.com/advisories/GHSA-2j5p-pq5g-pxh9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-117882","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0582.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36592","tags":["report"]},{"url":"https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_132.html","tags":["web"]},{"url":"https://www.firefox.com/en-US/firefox/153.6.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0583.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36593","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/153.6.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117867","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117872","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117883","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117887","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117894","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117941","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117942","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117943","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117944","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117948","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117951","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117952","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117954","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117958","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117963","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117964","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117971","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117972","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117985","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117988","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117992","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117995","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117997","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118004","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4761","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264928-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286385","tags":["report"]},{"url":"https://bugzilla.suse.com/1286955","tags":["report"]},{"url":"https://bugzilla.suse.com/1287809","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118004","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265145-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-117882","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-117882","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/#CVE-2026-117882","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/#CVE-2026-117882","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/#CVE-2026-117882","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118180","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-117882","title":"Use-after-free in the Layout component","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.","status":"published","published":"2026-10-27T14:05:10.636Z","modified":"2026-11-04T19:21:28.113Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-04T21:42:22.271694Z"}],"euvd":[{"id":"EUVD-2026-111053","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.","status":"published","published":"2026-10-27T14:05:10Z","modified":"2026-11-04T19:21:28Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-04T20:13:45.839046Z"}],"ghsa":[{"id":"GHSA-2j5p-pq5g-pxh9","title":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR...","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","status":"published","published":"2026-10-27T15:32:49Z","modified":"2026-11-04T21:33:15Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-04T21:42:46.194147Z"}],"nvd":[{"id":"CVE-2026-117882","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.","status":"published","published":"2026-10-27T14:16:43.563Z","modified":"2026-11-04T20:19:03.507Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-04T21:42:33.286916Z"}],"osv":[{"id":"DEBIAN-CVE-2026-117882","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.","status":"published","published":"2026-10-27T14:16:43.563Z","modified":"2026-11-05T10:00:42.188594079Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-4675","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.\r\n\r\nSecurity Fix(es):\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117860)\n\nSandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117861)\n\nPrivilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117862)\n\nInformation disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117863)\n\nSandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117864)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117865)\n\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117866)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117867)\n\nSandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117868)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117869)\n\nUse-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117870)\n\nInvalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117871)\n\nUse-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117872)\n\nIncorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117873)\n\nUse-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117874)\n\nUse-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117875)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117876)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117877)\n\nOther issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117878)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117879)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117880)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117881)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117882)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117883)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117884)\n\nUse-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117885)\n\nIncorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117886)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117887)\n\nUninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117888)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117889)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117890)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117891)\n\nPrivilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117892)\n\nIncorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117893)\n\nIncorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117894)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117895)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117896)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117897)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117898)\n\nUse-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117899)\n\nUse-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117900)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117901)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117902)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117903)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117904)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117905)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117906)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117907)\n\nUse-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117908)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117909)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117910)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117911)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117912)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117913)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117914)\n\nIncorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117915)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117916)\n\nInvalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117917)\n\nUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117918)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117919)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117920)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117921)\n\nUse-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117922)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117923)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117924)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117925)\n\nIncorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117926)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117927)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117928)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117929)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117930)\n\nUse-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117931)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117932)\n\nFrame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117933)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117934)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117935)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117936)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117937)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117938)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117939)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117940)\n\nUse-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117941)\n\nIncorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117942)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117943)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117944)\n\nIncorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117945)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117946)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117947)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117948)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117949)\n\nIncorrect boundary conditions in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117950)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117951)\n\nUninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117952)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117953)\n\nUse-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117954)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117955)\n\nInvalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117956)\n\nCryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117957)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117958)\n\nSite isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117959)\n\nSpoofing issue in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117960)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117961)\n\nSandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117962)\n\nIncorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117963)\n\nUse-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117964)\n\nSame-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117965)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117966)\n\nMitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117967)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117968)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117969)\n\nRace condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117970)\n\nSandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117971)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117972)\n\nUse-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117973)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117974)\n\nSandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117975)\n\nSite isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117976)\n\nOther issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117977)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117978)\n\nIncorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117979)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117980)\n\nPrivilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117981)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117982)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117983)\n\nIncorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117984)\n\nSandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117985)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117986)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117987)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117988)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117989)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117990)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117991)\n\nInformation disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117992)\n\nInteger overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117993)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117994)\n\nPrivilege escalation in the DOM: UI Events \u0026amp; Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117995)\n\nIncorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117996)\n\nSandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117997)\n\nMitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117998)\n\nRace condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117999)\n\nInformation disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118000)\n\nInformation disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118002)\n\nInformation disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118003)\n\nIncorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118004)","status":"published","published":"2026-11-04T13:54:22Z","modified":"2026-11-04T14:00:05.227352534Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4761","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.\r\n\r\nSecurity Fix(es):\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117860)\n\nSandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117861)\n\nPrivilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117862)\n\nInformation disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117863)\n\nSandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117864)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117865)\n\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117866)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117867)\n\nSandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117868)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117869)\n\nUse-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117870)\n\nInvalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117871)\n\nUse-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117872)\n\nIncorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117873)\n\nUse-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117874)\n\nUse-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117875)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117876)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117877)\n\nOther issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117878)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117879)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117880)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117881)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117882)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117883)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117884)\n\nUse-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117885)\n\nIncorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117886)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117887)\n\nUninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117888)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117889)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117890)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117891)\n\nPrivilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117892)\n\nIncorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117893)\n\nIncorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117894)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117895)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117896)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117897)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117898)\n\nUse-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117899)\n\nUse-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117900)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117901)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117902)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117903)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117904)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117905)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117906)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117907)\n\nUse-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117908)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117909)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117910)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117911)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117912)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117913)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117914)\n\nIncorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117915)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117916)\n\nInvalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117917)\n\nUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117918)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117919)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117920)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117921)\n\nUse-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117922)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117923)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117924)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117925)\n\nIncorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117926)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117927)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117928)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117929)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117930)\n\nUse-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117931)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117932)\n\nFrame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117933)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117934)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117935)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117936)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117937)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117938)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117939)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117940)\n\nUse-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117941)\n\nIncorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117942)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117943)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117944)\n\nIncorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117945)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117946)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117947)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117948)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117949)\n\nIncorrect boundary conditions in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117950)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117951)\n\nUninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117952)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117953)\n\nUse-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117954)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117955)\n\nInvalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117956)\n\nCryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117957)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117958)\n\nSite isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117959)\n\nSpoofing issue in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117960)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117961)\n\nSandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117962)\n\nIncorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117963)\n\nUse-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117964)\n\nSame-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117965)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117966)\n\nMitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117967)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117968)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117969)\n\nRace condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117970)\n\nSandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117971)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117972)\n\nUse-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117973)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117974)\n\nSandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117975)\n\nSite isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117976)\n\nOther issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117977)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117978)\n\nIncorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117979)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117980)\n\nPrivilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117981)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117982)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117983)\n\nIncorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117984)\n\nSandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117985)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117986)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117987)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117988)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117989)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117990)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117991)\n\nInformation disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117992)\n\nInteger overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117993)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117994)\n\nPrivilege escalation in the DOM: UI Events \u0026amp; Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117995)\n\nIncorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117996)\n\nSandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117997)\n\nMitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117998)\n\nRace condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117999)\n\nInformation disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118000)\n\nInformation disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118002)\n\nInformation disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118003)\n\nIncorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118004)","status":"published","published":"2026-11-11T12:25:54Z","modified":"2026-11-11T12:45:06.592292897Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-117882","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.","status":"published","published":"2026-10-27T14:16:00Z","modified":"2026-11-06T01:00:30.717975828Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T01:33:05.666804Z"},{"id":"MGASA-2026-0582","title":"Updated firefox, firefox-l10n, nss packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nSame-origin policy bypass in the DOM: Navigation component.\n(CVE-2026-117860)\nSandbox escape in the DOM: Navigation component. (CVE-2026-117861)\nPrivilege escalation due to incorrect boundary conditions in the\nNetworking component. (CVE-2026-117862)\nInformation disclosure due to uninitialized memory in the Audio/Video\ncomponent. (CVE-2026-117863)\nSandbox escape in the Form Manager component. (CVE-2026-117864)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117865)\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D\ncomponent. (CVE-2026-117866)\nUse-after-free in the Layout component. (CVE-2026-117867)\nSandbox escape in the DOM: Networking component. (CVE-2026-117868)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117869)\nUse-after-free in the JavaScript Engine component. (CVE-2026-117870)\nInvalid pointer in the Graphics component. (CVE-2026-117871)\nUse-after-free in the JavaScript: Standard Library component.\n(CVE-2026-117872)\nIncorrect boundary conditions in the Audio/Video: Playback component.\n(CVE-2026-117873)\nUse-after-free in the Internationalization component. (CVE-2026-117874)\nUse-after-free in the Layout: Scrolling and Overflow component.\n(CVE-2026-117875)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117876)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117877)\nOther issue, use-after-free in the Storage: IndexedDB component.\n(CVE-2026-117878)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117879)\nUse-after-free in the XML component. (CVE-2026-117880)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117881)\nUse-after-free in the Layout component. (CVE-2026-117882)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117883)\nUse-after-free in the Networking component. (CVE-2026-117884)\nUse-after-free in the Layout: Grid component. (CVE-2026-117885)\nIncorrect boundary conditions in the Graphics: Text component.\n(CVE-2026-117886)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117887)\nUninitialized memory in the Graphics: Canvas2D component.\n(CVE-2026-117888)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117889)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-117890)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117891)\nPrivilege escalation due to use-after-free in the WebRTC: Networking\ncomponent. (CVE-2026-117892)\nIncorrect boundary conditions in the Security: PSM component.\n(CVE-2026-117893)\nIncorrect boundary conditions in the WebRTC: Signaling component.\n(CVE-2026-117894)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117895)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117896)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117897)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117898)\nUse-after-free in the Networking: HTTP component. (CVE-2026-117899)\nUse-after-free in the DOM: Editor component. (CVE-2026-117900)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117901)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117902)\nUse-after-free in the Audio/Video component. (CVE-2026-117903)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117904)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117905)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117906)\nUse-after-free in the Networking component. (CVE-2026-117907)\nUse-after-free in the Graphics: ImageLib component. (CVE-2026-117908)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117909)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117910)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117911)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117912)\nUse-after-free in the SVG component. (CVE-2026-117913)\nUse-after-free in the SVG component. (CVE-2026-117914)\nIncorrect boundary conditions in the Layout: Block and Inline component.\n(CVE-2026-117915)\nUse-after-free in the XSLT component. (CVE-2026-117916)\nInvalid pointer in the Graphics: WebRender component. (CVE-2026-117917)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-117918)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117919)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117920)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117921)\nUse-after-free in the Networking: WebSockets component.\n(CVE-2026-117922)\nUse-after-free in the Audio/Video component. (CVE-2026-117923)\nUse-after-free in the XSLT component. (CVE-2026-117924)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117925)\nIncorrect boundary conditions in the SVG component. (CVE-2026-117926)\nUse-after-free in the SVG component. (CVE-2026-117927)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117928)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117929)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117930)\nUse-after-free in the DOM: Events component. (CVE-2026-117931)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117932)\nFrame poisoning in the CSS Parsing and Computation component.\n(CVE-2026-117933)\nUse-after-free in the Layout component. (CVE-2026-117934)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117935)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117936)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117937)\nUse-after-free in the Layout component. (CVE-2026-117938)\nUse-after-free in the XML component. (CVE-2026-117939)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117940)\nUse-after-free in the DOM: CSS Object Model component. (CVE-2026-117941)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-117942)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117943)\nUse-after-free in the Layout component. (CVE-2026-117944)\nIncorrect boundary conditions in the XML component. (CVE-2026-117945)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117946)\nUse-after-free in the XML component. (CVE-2026-117947)\nUse-after-free in the SVG component. (CVE-2026-117948)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117949)\nIncorrect boundary conditions in the DOM: Core \u0026 HTML component.\n(CVE-2026-117950)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117951)\nUninitialized memory in the Networking component. (CVE-2026-117952)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117953)\nUse-after-free in the Layout: Positioned component. (CVE-2026-117954)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-117955)\nPrivilege escalation in the DLL Services component. (CVE-2026-100801)\nInvalid pointer in the Nimbus Desktop Client component.\n(CVE-2026-117956)\nCryptographic issue in the WebRTC: Networking component.\n(CVE-2026-117957)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117958)\nSite isolation issue in the DOM: Service Workers component.\n(CVE-2026-117959)\nSpoofing issue in the DOM: Core \u0026 HTML component. (CVE-2026-117960)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117961)\nSandbox escape due to incorrect boundary conditions in the Storage:\nQuota Manager component. (CVE-2026-117962)\nIncorrect boundary conditions in the DOM: Service Workers component.\n(CVE-2026-117963)\nUse-after-free in the Panning and Zooming component. (CVE-2026-117964)\nSame-origin policy bypass in the Address Bar component.\n(CVE-2026-117965)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117966)\nMitigation bypass in the DOM: Security component. (CVE-2026-117967)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117968)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117969)\nRace condition in the Disability Access APIs component.\n(CVE-2026-117970)\nSandbox escape due to use-after-free in the Print Preview component.\n(CVE-2026-117971)\nUse-after-free in the Graphics component. (CVE-2026-117972)\nUse-after-free in the Networking: DNS component. (CVE-2026-117973)\nUse-after-free in the XML component. (CVE-2026-117974)\nSandbox escape due to invalid pointer in the Graphics: WebRender\ncomponent. (CVE-2026-117975)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-117976)\nOther issue in the Console component. (CVE-2026-117977)\nIncorrect boundary conditions in the Graphics component.\n(CVE-2026-117978)\nIncorrect boundary conditions in the Graphics: WebRender component.\n(CVE-2026-117979)\nUse-after-free in the Graphics component. (CVE-2026-117980)\nPrivilege escalation in the Toolkit component. (CVE-2026-117981)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117982)\nUse-after-free in the Graphics component. (CVE-2026-117983)\nIncorrect boundary conditions in the Layout: Scrolling and Overflow\ncomponent. (CVE-2026-117984)\nSandbox escape due to use-after-free in the Graphics component.\n(CVE-2026-117985)\nUse-after-free in the Graphics component. (CVE-2026-117986)\nUse-after-free in the Graphics component. (CVE-2026-117987)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nCanvasWebGL component. (CVE-2026-117988)\nUse-after-free in the Graphics component. (CVE-2026-117989)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nWebRender component. (CVE-2026-117990)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117991)\nInformation disclosure in the CSS Parsing and Computation component.\n(CVE-2026-117992)\nInteger overflow in the Graphics: Text component. (CVE-2026-117993)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117994)\nPrivilege escalation in the DOM: UI Events \u0026 Focus Handling component.\n(CVE-2026-117995)\nIncorrect boundary conditions in the WebRTC component. (CVE-2026-117996)\nSandbox escape due to use-after-free in the Widget component.\n(CVE-2026-117997)\nMitigation bypass in the DOM: Push Subscriptions component.\n(CVE-2026-117998)\nRace condition in the IPC component. (CVE-2026-117999)\nInformation disclosure in the Networking: HTTP component.\n(CVE-2026-118000)\nInformation disclosure due to race condition in the Networking\ncomponent. (CVE-2026-118002)\nInformation disclosure in the Networking: DNS component.\n(CVE-2026-118003)\nIncorrect boundary conditions in the CSS Transitions and Animations\ncomponent. (CVE-2026-118004)\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-09T16:58:25.50686427Z","updated_at":"2026-11-09T17:04:22.742827Z"},{"id":"MGASA-2026-0583","title":"Updated thunderbird package fixes security vulnerabilities","description":"Displaying a message could load an attacker-chosen URL through an\nOpenPGP key attachment. (CVE-2026-118174)\nContent of other messages could be included when replying to a crafted\nmessage. (CVE-2026-118175)\nBypass of remote UNC path restriction in mailbox: URLs.\n(CVE-2026-118176)\nCalendar discovery accepted local file and remote network share\nlocations. (CVE-2026-118177)\nRSS feed could redirect its subscription to a local file or network\nshare. (CVE-2026-118178)\nRequest forgery via news: links. (CVE-2026-118179)\nMatrix homeserver could redirect the chat session to a local file or\nnetwork share. (CVE-2026-118180)\nInteger overflow in libmime buffer growth could lead to heap corruption.\n(CVE-2026-110247)\nUse-after-free in S/MIME decryption during a security device password\nprompt. (CVE-2026-113869)\nSame-origin policy bypass in the DOM: Navigation component.\n(CVE-2026-117860)\nSandbox escape in the DOM: Navigation component. (CVE-2026-117861)\nPrivilege escalation due to incorrect boundary conditions in the\nNetworking component. (CVE-2026-117862)\nInformation disclosure due to uninitialized memory in the Audio/Video\ncomponent. (CVE-2026-117863)\nSandbox escape in the Form Manager component. (CVE-2026-117864)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117865)\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D\ncomponent. (CVE-2026-117866)\nUse-after-free in the Layout component. (CVE-2026-117867)\nSandbox escape in the DOM: Networking component. (CVE-2026-117868)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117869)\nUse-after-free in the JavaScript Engine component. (CVE-2026-117870)\nInvalid pointer in the Graphics component. (CVE-2026-117871)\nUse-after-free in the JavaScript: Standard Library component.\n(CVE-2026-117872)\nIncorrect boundary conditions in the Audio/Video: Playback component.\n(CVE-2026-117873)\nUse-after-free in the Internationalization component. (CVE-2026-117874)\nUse-after-free in the Layout: Scrolling and Overflow component.\n(CVE-2026-117875)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117876)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117877)\nOther issue, use-after-free in the Storage: IndexedDB component.\n(CVE-2026-117878)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117879)\nUse-after-free in the XML component. (CVE-2026-117880)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117881)\nUse-after-free in the Layout component. (CVE-2026-117882)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117883)\nUse-after-free in the Networking component. (CVE-2026-117884)\nUse-after-free in the Layout: Grid component. (CVE-2026-117885)\nIncorrect boundary conditions in the Graphics: Text component.\n(CVE-2026-117886)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117887)\nUninitialized memory in the Graphics: Canvas2D component.\n(CVE-2026-117888)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117889)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-117890)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117891)\nPrivilege escalation due to use-after-free in the WebRTC: Networking\ncomponent. (CVE-2026-117892)\nIncorrect boundary conditions in the Security: PSM component.\n(CVE-2026-117893)\nIncorrect boundary conditions in the WebRTC: Signaling component.\n(CVE-2026-117894)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117895)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117896)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117897)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117898)\nUse-after-free in the Networking: HTTP component. (CVE-2026-117899)\nUse-after-free in the DOM: Editor component. (CVE-2026-117900)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117901)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117902)\nUse-after-free in the Audio/Video component. (CVE-2026-117903)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117904)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117905)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117906)\nUse-after-free in the Networking component. (CVE-2026-117907)\nUse-after-free in the Graphics: ImageLib component. (CVE-2026-117908)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117909)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117910)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117911)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117912)\nUse-after-free in the SVG component. (CVE-2026-117913)\nUse-after-free in the SVG component. (CVE-2026-117914)\nIncorrect boundary conditions in the Layout: Block and Inline component.\n(CVE-2026-117915)\nUse-after-free in the XSLT component. (CVE-2026-117916)\nInvalid pointer in the Graphics: WebRender component. (CVE-2026-117917)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-117918)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117919)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117920)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117921)\nUse-after-free in the Networking: WebSockets component.\n(CVE-2026-117922)\nUse-after-free in the Audio/Video component. (CVE-2026-117923)\nUse-after-free in the XSLT component. (CVE-2026-117924)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117925)\nIncorrect boundary conditions in the SVG component. (CVE-2026-117926)\nUse-after-free in the SVG component. (CVE-2026-117927)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117928)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117929)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117930)\nUse-after-free in the DOM: Events component. (CVE-2026-117931)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117932)\nFrame poisoning in the CSS Parsing and Computation component.\n(CVE-2026-117933)\nUse-after-free in the Layout component. (CVE-2026-117934)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117935)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117936)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117937)\nUse-after-free in the Layout component. (CVE-2026-117938)\nUse-after-free in the XML component. (CVE-2026-117939)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117940)\nUse-after-free in the DOM: CSS Object Model component. (CVE-2026-117941)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-117942)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117943)\nUse-after-free in the Layout component. (CVE-2026-117944)\nIncorrect boundary conditions in the XML component. (CVE-2026-117945)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117946)\nUse-after-free in the XML component. (CVE-2026-117947)\nUse-after-free in the SVG component. (CVE-2026-117948)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117949)\nIncorrect boundary conditions in the DOM: Core \u0026 HTML component.\n(CVE-2026-117950)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117951)\nUninitialized memory in the Networking component. (CVE-2026-117952)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117953)\nUse-after-free in the Layout: Positioned component. (CVE-2026-117954)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-117955)\nPrivilege escalation in the DLL Services component. (CVE-2026-100801)\nInvalid pointer in the Nimbus Desktop Client component.\n(CVE-2026-117956)\nCryptographic issue in the WebRTC: Networking component.\n(CVE-2026-117957)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117958)\nSite isolation issue in the DOM: Service Workers component.\n(CVE-2026-117959)\nSpoofing issue in the DOM: Core \u0026 HTML component. (CVE-2026-117960)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117961)\nSandbox escape due to incorrect boundary conditions in the Storage:\nQuota Manager component. (CVE-2026-117962)\nIncorrect boundary conditions in the DOM: Service Workers component.\n(CVE-2026-117963)\nUse-after-free in the Panning and Zooming component. (CVE-2026-117964)\nSame-origin policy bypass in the Address Bar component.\n(CVE-2026-117965)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117966)\nMitigation bypass in the DOM: Security component. (CVE-2026-117967)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117968)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117969)\nRace condition in the Disability Access APIs component.\n(CVE-2026-117970)\nSandbox escape due to use-after-free in the Print Preview component.\n(CVE-2026-117971)\nUse-after-free in the Graphics component. (CVE-2026-117972)\nUse-after-free in the Networking: DNS component. (CVE-2026-117973)\nUse-after-free in the XML component. (CVE-2026-117974)\nSandbox escape due to invalid pointer in the Graphics: WebRender\ncomponent. (CVE-2026-117975)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-117976)\nOther issue in the Console component. (CVE-2026-117977)\nIncorrect boundary conditions in the Graphics component.\n(CVE-2026-117978)\nIncorrect boundary conditions in the Graphics: WebRender component.\n(CVE-2026-117979)\nUse-after-free in the Graphics component. (CVE-2026-117980)\nPrivilege escalation in the Toolkit component. (CVE-2026-117981)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117982)\nUse-after-free in the Graphics component. (CVE-2026-117983)\nIncorrect boundary conditions in the Layout: Scrolling and Overflow\ncomponent. (CVE-2026-117984)\nSandbox escape due to use-after-free in the Graphics component.\n(CVE-2026-117985)\nUse-after-free in the Graphics component. (CVE-2026-117986)\nUse-after-free in the Graphics component. (CVE-2026-117987)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nCanvasWebGL component. (CVE-2026-117988)\nUse-after-free in the Graphics component. (CVE-2026-117989)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nWebRender component. (CVE-2026-117990)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117991)\nInformation disclosure in the CSS Parsing and Computation component.\n(CVE-2026-117992)\nInteger overflow in the Graphics: Text component. (CVE-2026-117993)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117994)\nPrivilege escalation in the DOM: UI Events \u0026 Focus Handling component.\n(CVE-2026-117995)\nIncorrect boundary conditions in the WebRTC component. (CVE-2026-117996)\nSandbox escape due to use-after-free in the Widget component.\n(CVE-2026-117997)\nMitigation bypass in the DOM: Push Subscriptions component.\n(CVE-2026-117998)\nRace condition in the IPC component. (CVE-2026-117999)\nInformation disclosure in the Networking: HTTP component.\n(CVE-2026-118000)\nInformation disclosure due to race condition in the Networking\ncomponent. (CVE-2026-118002)\nInformation disclosure in the Networking: DNS component.\n(CVE-2026-118003)\nIncorrect boundary conditions in the CSS Transitions and Animations\ncomponent. (CVE-2026-118004)\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-10T05:45:03.377121818Z","updated_at":"2026-11-10T05:53:01.608209Z"},{"id":"openSUSE-SU-2026:12319-1","title":"firefox-esr-153.6.0-1.1 on GA media","description":"These are all security issues fixed in the firefox-esr-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:07.049639871Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12339-1","title":"MozillaThunderbird-153.6.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:07.691910442Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4928-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nUpdate to Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-112, MFSA 2026-120, bsc#1286385):\n\n- CVE-2026-100801: Privilege escalation in the DLL Services component.\n- CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component\n  (bsc#1286261).\n- CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component.\n- CVE-2026-117861: Sandbox escape in the DOM: Navigation component.\n- CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component.\n- CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component.\n- CVE-2026-117864: Sandbox escape in the Form Manager component.\n- CVE-2026-117865: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-117867: Use-after-free in the Layout component.\n- CVE-2026-117868: Sandbox escape in the DOM: Networking component.\n- CVE-2026-117869: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117870: Use-after-free in the JavaScript Engine component.\n- CVE-2026-117871: Invalid pointer in the Graphics component.\n- CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component.\n- CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component.\n- CVE-2026-117874: Use-after-free in the Internationalization component.\n- CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component.\n- CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component.\n- CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component.\n- CVE-2026-117880: Use-after-free in the XML component.\n- CVE-2026-117881: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117882: Use-after-free in the Layout component.\n- CVE-2026-117883: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-117884: Use-after-free in the Networking component.\n- CVE-2026-117885: Use-after-free in the Layout: Grid component.\n- CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component.\n- CVE-2026-117887: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component.\n- CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component.\n- CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component.\n- CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component.\n- CVE-2026-117895: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117896: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component.\n- CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-117899: Use-after-free in the Networking: HTTP component.\n- CVE-2026-117900: Use-after-free in the DOM: Editor component.\n- CVE-2026-117901: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-117903: Use-after-free in the Audio/Video component.\n- CVE-2026-117904: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117905: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-117907: Use-after-free in the Networking component.\n- CVE-2026-117908: Use-after-free in the Graphics: ImageLib component.\n- CVE-2026-117909: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117910: Invalid pointer in the JavaScript Engine component.\n- CVE-2026-117911: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component.\n- CVE-2026-117913: Use-after-free in the SVG component.\n- CVE-2026-117914: Use-after-free in the SVG component.\n- CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component.\n- CVE-2026-117916: Use-after-free in the XSLT component.\n- CVE-2026-117917: Invalid pointer in the Graphics: WebRender component.\n- CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-117919: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117920: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-117922: Use-after-free in the Networking: WebSockets component.\n- CVE-2026-117923: Use-after-free in the Audio/Video component.\n- CVE-2026-117924: Use-after-free in the XSLT component.\n- CVE-2026-117925: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117926: Incorrect boundary conditions in the SVG component.\n- CVE-2026-117927: Use-after-free in the SVG component.\n- CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component.\n- CVE-2026-117929: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-117931: Use-after-free in the DOM: Events component.\n- CVE-2026-117932: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component.\n- CVE-2026-117934: Use-after-free in the Layout component.\n- CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-117936: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117937: Invalid pointer in the JavaScript Engine component.\n- CVE-2026-117938: Use-after-free in the Layout component.\n- CVE-2026-117939: Use-after-free in the XML component.\n- CVE-2026-117940: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component.\n- CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-117943: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117944: Use-after-free in the Layout component.\n- CVE-2026-117945: Incorrect boundary conditions in the XML component.\n- CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-117947: Use-after-free in the XML component.\n- CVE-2026-117948: Use-after-free in the SVG component.\n- CVE-2026-117949: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117950: Incorrect boundary conditions in the DOM: Core \u0026 HTML component.\n- CVE-2026-117951: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117952: Uninitialized memory in the Networking component.\n- CVE-2026-117953: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117954: Use-after-free in the Layout: Positioned component.\n- CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component.\n- CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component.\n- CVE-2026-117958: Site isolation issue in the Networking: HTTP component.\n- CVE-2026-117959: Site isolation issue in the DOM: Service Workers component.\n- CVE-2026-117960: Spoofing issue in the DOM: Core \u0026 HTML component.\n- CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component.\n- CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component.\n- CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component.\n- CVE-2026-117964: Use-after-free in the Panning and Zooming component.\n- CVE-2026-117965: Same-origin policy bypass in the Address Bar component.\n- CVE-2026-117966: Site isolation issue in the Networking: HTTP component.\n- CVE-2026-117967: Mitigation bypass in the DOM: Security component.\n- CVE-2026-117968: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component.\n- CVE-2026-117970: Race condition in the Disability Access APIs component.\n- CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview component.\n- CVE-2026-117972: Use-after-free in the Graphics component.\n- CVE-2026-117973: Use-after-free in the Networking: DNS component.\n- CVE-2026-117974: Use-after-free in the XML component.\n- CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics: WebRender component.\n- CVE-2026-117976: Site isolation issue in the DOM: Navigation component.\n- CVE-2026-117977: Other issue in the Console component.\n- CVE-2026-117978: Incorrect boundary conditions in the Graphics component.\n- CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-117980: Use-after-free in the Graphics component.\n- CVE-2026-117981: Privilege escalation in the Toolkit component.\n- CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component.\n- CVE-2026-117983: Use-after-free in the Graphics component.\n- CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and Overflow component.\n- CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics component.\n- CVE-2026-117986: Use-after-free in the Graphics component.\n- CVE-2026-117987: Use-after-free in the Graphics component.\n- CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-117989: Use-after-free in the Graphics component.\n- CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts component.\n- CVE-2026-117992: Information disclosure in the CSS Parsing and Computation component.\n- CVE-2026-117993: Integer overflow in the Graphics: Text component.\n- CVE-2026-117994: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117995: Privilege escalation in the DOM: UI Events \u0026 Focus Handling component.\n- CVE-2026-117996: Incorrect boundary conditions in the WebRTC component.\n- CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component.\n- CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component.\n- CVE-2026-117999: Race condition in the IPC component.\n- CVE-2026-118000: Information disclosure in the Networking: HTTP component.\n- CVE-2026-118002: Information disclosure due to race condition in the Networking component.\n- CVE-2026-118003: Information disclosure in the Networking: DNS component.\n- CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and Animations component.\n","status":"published","published":"2026-10-29T08:52:15Z","modified":"2026-10-31T18:00:04.936593677Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:5145-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nUpdate to Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-112, MFSA 2026-120, bsc#1286385):\n\n- CVE-2026-100801: Privilege escalation in the DLL Services component.\n- CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component\n  (bsc#1286261).\n- CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component.\n- CVE-2026-117861: Sandbox escape in the DOM: Navigation component.\n- CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component.\n- CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component.\n- CVE-2026-117864: Sandbox escape in the Form Manager component.\n- CVE-2026-117865: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-117867: Use-after-free in the Layout component.\n- CVE-2026-117868: Sandbox escape in the DOM: Networking component.\n- CVE-2026-117869: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117870: Use-after-free in the JavaScript Engine component.\n- CVE-2026-117871: Invalid pointer in the Graphics component.\n- CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component.\n- CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component.\n- CVE-2026-117874: Use-after-free in the Internationalization component.\n- CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component.\n- CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component.\n- CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component.\n- CVE-2026-117880: Use-after-free in the XML component.\n- CVE-2026-117881: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117882: Use-after-free in the Layout component.\n- CVE-2026-117883: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-117884: Use-after-free in the Networking component.\n- CVE-2026-117885: Use-after-free in the Layout: Grid component.\n- CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component.\n- CVE-2026-117887: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component.\n- CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component.\n- CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component.\n- CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component.\n- CVE-2026-117895: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117896: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component.\n- CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-117899: Use-after-free in the Networking: HTTP component.\n- CVE-2026-117900: Use-after-free in the DOM: Editor component.\n- CVE-2026-117901: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-117903: Use-after-free in the Audio/Video component.\n- CVE-2026-117904: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117905: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-117907: Use-after-free in the Networking component.\n- CVE-2026-117908: Use-after-free in the Graphics: ImageLib component.\n- CVE-2026-117909: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117910: Invalid pointer in the JavaScript Engine component.\n- CVE-2026-117911: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component.\n- CVE-2026-117913: Use-after-free in the SVG component.\n- CVE-2026-117914: Use-after-free in the SVG component.\n- CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component.\n- CVE-2026-117916: Use-after-free in the XSLT component.\n- CVE-2026-117917: Invalid pointer in the Graphics: WebRender component.\n- CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-117919: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117920: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-117922: Use-after-free in the Networking: WebSockets component.\n- CVE-2026-117923: Use-after-free in the Audio/Video component.\n- CVE-2026-117924: Use-after-free in the XSLT component.\n- CVE-2026-117925: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117926: Incorrect boundary conditions in the SVG component.\n- CVE-2026-117927: Use-after-free in the SVG component.\n- CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component.\n- CVE-2026-117929: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-117931: Use-after-free in the DOM: Events component.\n- CVE-2026-117932: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component.\n- CVE-2026-117934: Use-after-free in the Layout component.\n- CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-117936: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117937: Invalid pointer in the JavaScript Engine component.\n- CVE-2026-117938: Use-after-free in the Layout component.\n- CVE-2026-117939: Use-after-free in the XML component.\n- CVE-2026-117940: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component.\n- CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-117943: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117944: Use-after-free in the Layout component.\n- CVE-2026-117945: Incorrect boundary conditions in the XML component.\n- CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-117947: Use-after-free in the XML component.\n- CVE-2026-117948: Use-after-free in the SVG component.\n- CVE-2026-117949: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117950: Incorrect boundary conditions in the DOM: Core \u0026 HTML component.\n- CVE-2026-117951: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117952: Uninitialized memory in the Networking component.\n- CVE-2026-117953: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117954: Use-after-free in the Layout: Positioned component.\n- CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component.\n- CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component.\n- CVE-2026-117958: Site isolation issue in the Networking: HTTP component.\n- CVE-2026-117959: Site isolation issue in the DOM: Service Workers component.\n- CVE-2026-117960: Spoofing issue in the DOM: Core \u0026 HTML component.\n- CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component.\n- CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component.\n- CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component.\n- CVE-2026-117964: Use-after-free in the Panning and Zooming component.\n- CVE-2026-117965: Same-origin policy bypass in the Address Bar component.\n- CVE-2026-117966: Site isolation issue in the Networking: HTTP component.\n- CVE-2026-117967: Mitigation bypass in the DOM: Security component.\n- CVE-2026-117968: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component.\n- CVE-2026-117970: Race condition in the Disability Access APIs component.\n- CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview component.\n- CVE-2026-117972: Use-after-free in the Graphics component.\n- CVE-2026-117973: Use-after-free in the Networking: DNS component.\n- CVE-2026-117974: Use-after-free in the XML component.\n- CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics: WebRender component.\n- CVE-2026-117976: Site isolation issue in the DOM: Navigation component.\n- CVE-2026-117977: Other issue in the Console component.\n- CVE-2026-117978: Incorrect boundary conditions in the Graphics component.\n- CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-117980: Use-after-free in the Graphics component.\n- CVE-2026-117981: Privilege escalation in the Toolkit component.\n- CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component.\n- CVE-2026-117983: Use-after-free in the Graphics component.\n- CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and Overflow component.\n- CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics component.\n- CVE-2026-117986: Use-after-free in the Graphics component.\n- CVE-2026-117987: Use-after-free in the Graphics component.\n- CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-117989: Use-after-free in the Graphics component.\n- CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts component.\n- CVE-2026-117992: Information disclosure in the CSS Parsing and Computation component.\n- CVE-2026-117993: Integer overflow in the Graphics: Text component.\n- CVE-2026-117994: Use-after-free in the JavaScript: GC component.\n- CVE-2026-117995: Privilege escalation in the DOM: UI Events \u0026 Focus Handling component.\n- CVE-2026-117996: Incorrect boundary conditions in the WebRTC component.\n- CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component.\n- CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component.\n- CVE-2026-117999: Race condition in the IPC component.\n- CVE-2026-118000: Information disclosure in the Networking: HTTP component.\n- CVE-2026-118002: Information disclosure due to race condition in the Networking component.\n- CVE-2026-118003: Information disclosure in the Networking: DNS component.\n- CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and Animations component.\n","status":"published","published":"2026-11-09T14:15:31Z","modified":"2026-11-10T13:15:10.753610174Z","updated_at":"2026-11-10T13:29:51.103746Z"}]}}