{"id":"CVE-2026-118019","aliases":["DEBIAN-CVE-2026-118019","EUVD-2026-110917","GHSA-v636-fg4v-7pgq","SUSE-SU-2026:5174-1","UBUNTU-CVE-2026-118019"],"status":"published","title":"Race condition, use-after-free in the DOM: File component","description":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00198,"percentile":0.09661,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362"],"published":"2026-10-27T14:06:03Z","modified":"2026-11-11T13:00:04Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0esr-1","102.12.0esr-1","102.12.0esr-1~deb10u1","102.12.0esr-1~deb11u1","102.12.0esr-1~deb12u1","102.13.0esr-1","102.13.0esr-1~deb10u1","102.13.0esr-1~deb11u1","102.13.0esr-1~deb12u1","102.14.0esr-1~deb10u1","102.14.0esr-1~deb11u1","102.14.0esr-1~deb12u1","102.15.0esr-1~deb10u1","102.15.0esr-1~deb11u1","102.15.0esr-1~deb12u1","102.15.1esr-1~deb10u1","102.15.1esr-1~deb11u1","102.15.1esr-1~deb12u1","115.0.2esr-1","115.1.0esr-1","115.10.0esr-1","115.10.0esr-1~deb10u1","115.10.0esr-1~deb11u1","115.10.0esr-1~deb12u1","115.11.0esr-1","115.11.0esr-1~deb10u1","115.11.0esr-1~deb11u1","115.11.0esr-1~deb12u1","115.12.0esr-1","115.12.0esr-1~deb10u1","115.12.0esr-1~deb11u1","115.12.0esr-1~deb12u1","115.13.0esr-1","115.13.0esr-1~deb11u1","115.13.0esr-1~deb12u1","115.13.0esr-2","115.14.0esr-1","115.14.0esr-1~deb11u1","115.14.0esr-1~deb12u1","115.15.0esr-1","115.15.0esr-1~deb11u1","115.15.0esr-1~deb12u1","115.2.0esr-1","115.2.1esr-1","115.3.0esr-1","115.3.0esr-1~deb10u1","115.3.0esr-1~deb11u1","115.3.0esr-1~deb12u1","115.3.1esr-1~deb10u1","115.3.1esr-1~deb11u1","115.4.0esr-1","115.4.0esr-1~deb10u1","115.4.0esr-1~deb11u1","115.4.0esr-1~deb12u1","115.5.0esr-1","115.5.0esr-1~deb10u1","115.5.0esr-1~deb11u1","115.5.0esr-1~deb12u1","115.6.0esr-1","115.6.0esr-1~deb10u1","115.6.0esr-1~deb11u1","115.6.0esr-1~deb12u1","115.7.0esr-1","115.7.0esr-1~deb10u1","115.7.0esr-1~deb11u1","115.7.0esr-1~deb12u1","115.8.0esr-1","115.8.0esr-1~deb10u1","115.8.0esr-1~deb11u1","115.8.0esr-1~deb12u1","115.9.0esr-1","115.9.0esr-1~deb11u1","115.9.0esr-1~deb12u1","115.9.0esr-2","115.9.1esr-1","115.9.1esr-1~deb10u1","115.9.1esr-1~deb11u1","115.9.1esr-1~deb12u1","128.10.0esr-1","128.10.0esr-1~deb12u1","128.10.1esr-1","128.10.1esr-1~deb11u1","128.10.1esr-1~deb12u1","128.11.0esr-1","128.11.0esr-1~deb11u1","128.11.0esr-1~deb12u1","128.12.0esr-1","128.12.0esr-1~deb11u1","128.12.0esr-1~deb12u1","128.13.0esr-1","128.13.0esr-1~deb11u1","128.13.0esr-1~deb12u1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","128.3.0esr-1","128.3.0esr-1~deb11u1","128.3.0esr-1~deb11u2","128.3.0esr-1~deb12u1","128.3.0esr-2","128.3.1esr-1","128.3.1esr-1~deb11u1","128.3.1esr-1~deb12u1","128.3.1esr-2","128.4.0esr-1","128.4.0esr-1~deb11u1","128.4.0esr-1~deb12u1","128.5.0esr-1","128.5.0esr-1~deb11u1","128.5.0esr-1~deb12u1","128.5.1esr-1","128.6.0esr-1","128.6.0esr-1~deb11u1","128.6.0esr-1~deb11u2","128.6.0esr-1~deb11u3","128.6.0esr-1~deb12u1","128.6.0esr-2","128.6.0esr-3","128.6.0esr-4","128.7.0esr-1","128.7.0esr-1~deb11u1","128.7.0esr-1~deb12u1","128.8.0esr-1","128.8.0esr-1~deb11u1","128.8.0esr-1~deb12u1","128.9.0esr-1","128.9.0esr-1~deb11u1","128.9.0esr-1~deb12u1","128.9.0esr-2","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.13.0esr-1~deb13u1","140.13.0esr-2","140.14.0esr-1~deb11u1","140.14.0esr-1~deb12u1","140.14.0esr-1~deb13u1","140.14.0esr-2","140.15.0esr-1","140.15.0esr-1~deb12u1","140.15.0esr-1~deb13u1","140.16.0esr-1","140.16.0esr-1~deb12u1","140.16.0esr-1~deb13u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1","153.1.0esr-1","153.2.0esr-1","153.3.0esr-1","153.4.0esr-1","153.4.0esr-1~deb12u1","153.4.0esr-1~deb13u1","153.5.0esr-1","153.5.0esr-1~deb12u1","153.5.0esr-1~deb13u1","153.5.1esr-1","153.5.1esr-1~deb12u1","153.5.1esr-1~deb13u1","153.6.0esr-1","153.6.0esr-1~deb12u1","153.6.0esr-1~deb12u2","153.6.0esr-1~deb13u1","153.7.0esr-1","153.7.0esr-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["128.13.0esr-1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.13.0esr-1~deb13u1","140.13.0esr-2","140.14.0esr-1~deb11u1","140.14.0esr-1~deb12u1","140.14.0esr-1~deb13u1","140.14.0esr-2","140.15.0esr-1","140.15.0esr-1~deb12u1","140.15.0esr-1~deb13u1","140.16.0esr-1","140.16.0esr-1~deb12u1","140.16.0esr-1~deb13u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1","153.1.0esr-1","153.2.0esr-1","153.3.0esr-1","153.4.0esr-1","153.4.0esr-1~deb12u1","153.4.0esr-1~deb13u1","153.5.0esr-1","153.5.0esr-1~deb12u1","153.5.0esr-1~deb13u1","153.5.1esr-1","153.5.1esr-1~deb12u1","153.5.1esr-1~deb13u1","153.6.0esr-1","153.6.0esr-1~deb12u1","153.6.0esr-1~deb12u2","153.6.0esr-1~deb13u1","153.7.0esr-1","153.7.0esr-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["128.13.0esr-1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.13.0esr-1~deb13u1","140.13.0esr-2","140.14.0esr-1~deb11u1","140.14.0esr-1~deb12u1","140.14.0esr-1~deb13u1","140.14.0esr-2","140.15.0esr-1","140.15.0esr-1~deb12u1","140.15.0esr-1~deb13u1","140.16.0esr-1","140.16.0esr-1~deb12u1","140.16.0esr-1~deb13u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1","153.1.0esr-1","153.2.0esr-1","153.3.0esr-1","153.4.0esr-1","153.4.0esr-1~deb12u1","153.4.0esr-1~deb13u1","153.5.0esr-1","153.5.0esr-1~deb12u1","153.5.0esr-1~deb13u1","153.5.1esr-1","153.5.1esr-1~deb12u1","153.5.1esr-1~deb13u1","153.6.0esr-1","153.6.0esr-1~deb12u1","153.6.0esr-1~deb12u2","153.6.0esr-1~deb13u1","153.7.0esr-1","153.7.0esr-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1","1:102.13.1-1~deb12u1","1:102.14.0-1~deb10u1","1:102.14.0-1~deb11u1","1:102.14.0-1~deb12u1","1:102.15.0-1~deb10u1","1:102.15.0-1~deb11u1","1:102.15.0-1~deb12u1","1:102.15.1-1~deb10u1","1:102.15.1-1~deb11u1","1:102.15.1-1~deb12u1","1:103.0~b5-1","1:104.0~b2-1","1:110.0~b4-1","1:112.0~b1-1","1:113.0~b3-1","1:114.0~b2-1","1:115.0-1","1:115.0.1-1","1:115.0.1-2","1:115.0~b4-1","1:115.0~b6-1","1:115.1.0-1","1:115.1.1-1","1:115.10.1-1","1:115.10.1-1~deb10u1","1:115.10.1-1~deb11u1","1:115.10.1-1~deb12u1","1:115.11.0-1","1:115.11.0-1~deb10u1","1:115.11.0-1~deb11u1","1:115.11.0-1~deb12u1","1:115.12.0-1","1:115.12.0-1~deb10u1","1:115.12.0-1~deb11u1","1:115.12.0-1~deb12u1","1:115.13.0-1","1:115.13.0-1~deb11u1","1:115.13.0-1~deb12u1","1:115.14.0-1~deb11u1","1:115.14.0-1~deb12u1","1:115.15.0-1~deb11u1","1:115.15.0-1~deb12u1","1:115.16.0esr-1~deb11u1","1:115.16.0esr-1~deb12u1","1:115.2.0-1","1:115.2.2-1","1:115.3.0-1","1:115.3.0-1~deb12u1","1:115.3.1-1","1:115.3.1-1~deb10u1","1:115.3.1-1~deb11u1","1:115.3.1-1~deb12u1","1:115.4.1-1","1:115.4.1-1~deb10u1","1:115.4.1-1~deb11u1","1:115.4.1-1~deb12u1","1:115.5.0-1","1:115.5.0-1~deb10u1","1:115.5.0-1~deb11u1","1:115.5.0-1~deb12u1","1:115.5.1-1","1:115.5.2-1","1:115.6.0-1","1:115.6.0-1~deb10u1","1:115.6.0-1~deb11u1","1:115.6.0-1~deb12u1","1:115.7.0-1","1:115.7.0-1~deb10u1","1:115.7.0-1~deb11u1","1:115.7.0-1~deb12u1","1:115.8.0-1","1:115.8.0-1~deb10u1","1:115.8.0-1~deb11u1","1:115.8.0-1~deb12u1","1:115.8.1-1","1:115.9.0-1","1:115.9.0-1~deb10u1","1:115.9.0-1~deb11u1","1:115.9.0-1~deb12u1","1:116.0~b7-1","1:117.0~b5-1","1:120.0~b1-1","1:121.0~b3-1","1:122.0~b2-1","1:124.0~b5-1","1:125.0~b3-1","1:127.0~b5-1","1:128.0esr-1","1:128.0~b5-1","1:128.1.0esr-1","1:128.1.1esr-1","1:128.10.0esr-1","1:128.10.0esr-1~deb11u1","1:128.10.0esr-1~deb12u1","1:128.10.1esr-1","1:128.10.1esr-1~deb11u1","1:128.10.1esr-1~deb12u1","1:128.11.0esr-1","1:128.11.0esr-1~deb11u1","1:128.11.0esr-1~deb12u1","1:128.12.0esr-1","1:128.12.0esr-1~deb11u1","1:128.12.0esr-1~deb12u1","1:128.13.0esr-1","1:128.13.0esr-1~deb11u1","1:128.13.0esr-1~deb12u1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:128.2.0esr-1","1:128.2.1esr-1","1:128.2.3esr-1","1:128.3.0esr-1","1:128.3.2esr-1","1:128.4.0esr-1","1:128.4.0esr-1~deb11u1","1:128.4.0esr-1~deb12u1","1:128.4.2esr-1","1:128.4.3esr-1","1:128.4.3esr-1~deb11u1","1:128.4.3esr-1~deb12u1","1:128.5.0esr-1","1:128.5.0esr-1~deb11u1","1:128.5.0esr-1~deb12u1","1:128.5.2esr-1","1:128.6.0esr-1","1:128.6.0esr-1~deb11u1","1:128.6.0esr-1~deb12u1","1:128.7.0esr-1","1:128.7.0esr-1~deb11u1","1:128.7.0esr-1~deb12u1","1:128.8.0esr-1","1:128.8.0esr-1~deb11u1","1:128.8.0esr-1~deb12u1","1:128.9.0esr-1","1:128.9.0esr-1~deb11u1","1:128.9.0esr-1~deb12u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1","1:153.6.0esr-1~deb12u1","1:153.6.0esr-1~deb12u2","1:153.6.0esr-1~deb13u1","1:153.7.0esr-1","1:155.0.1-1","1:155.0.1-2","1:157.0-1","1:159.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1","1:153.6.0esr-1~deb12u1","1:153.6.0esr-1~deb12u2","1:153.6.0esr-1~deb13u1","1:153.7.0esr-1","1:155.0.1-1","1:155.0.1-2","1:157.0-1","1:159.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.13.0esr-2~deb13u1","1:140.14.0esr-1","1:140.14.0esr-1~deb11u1","1:140.14.0esr-1~deb12u1","1:140.14.0esr-1~deb13u1","1:140.15.0esr-1~deb12u1","1:140.15.0esr-1~deb13u1","1:140.16.0esr-1~deb12u1","1:140.16.0esr-1~deb13u1","1:140.17.0esr-1~deb12u1","1:140.17.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1","1:143.0.1-1","1:144.0.1-1","1:148.0.1-1","1:149.0.2-1","1:152.0-1","1:153.0.1esr-1","1:153.0.3esr-1","1:153.1.0esr-1","1:153.2.0esr-1","1:153.3.0esr-1","1:153.3.0esr-2","1:153.4.0esr-1","1:153.5.0esr-1","1:153.5.1esr-1","1:153.5.1esr-1~deb12u1","1:153.5.1esr-1~deb13u1","1:153.5.1esr-1~deb13u2","1:153.6.0esr-1","1:153.6.0esr-1~deb12u1","1:153.6.0esr-1~deb12u2","1:153.6.0esr-1~deb13u1","1:153.7.0esr-1","1:155.0.1-1","1:155.0.1-2","1:157.0-1","1:159.0-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.7.0-118.22.1"}]}],"bundled":81},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.7.0-118.22.1"}]}],"bundled":81},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0-0ubuntu0.22.04.1","102.12.0-0ubuntu0.22.04.1","102.13.0-0ubuntu0.22.04.1","102.15.1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.15.1-1","102.15.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["115.3.0-0ubuntu1","115.4.0-2","115.5.0-1","115.6.0-1","115.7.0-4","115.8.0-1","115.9.0-1","115.9.0-1build1","115.10.0-1"]}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2025386","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-118/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-121/","tags":["report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118019"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-118"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-121"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-127"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-129"},{"url":"https://github.com/advisories/GHSA-v636-fg4v-7pgq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-118019","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265174-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1289275","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-124951","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-118019","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118019","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/#CVE-2026-118019","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-118019","title":"Race condition, use-after-free in the DOM: File component","description":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7.","status":"published","published":"2026-10-27T14:06:03.344Z","modified":"2026-11-10T20:24:04.966Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-10T22:18:26.309435Z"}],"euvd":[{"id":"EUVD-2026-110917","description":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7.","status":"published","published":"2026-10-27T14:06:03Z","modified":"2026-11-10T20:24:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T21:23:25.228377Z"}],"ghsa":[{"id":"GHSA-v636-fg4v-7pgq","title":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in...","description":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159.","status":"published","published":"2026-10-27T15:33:04Z","modified":"2026-11-10T21:31:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-10T21:57:46.822341Z"}],"nvd":[{"id":"CVE-2026-118019","description":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7.","status":"published","published":"2026-10-27T14:16:59.687Z","modified":"2026-11-10T21:18:57.96Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-11T00:21:51.566932Z"}],"osv":[{"id":"DEBIAN-CVE-2026-118019","description":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7.","status":"published","published":"2026-10-27T14:16:59.687Z","modified":"2026-11-11T10:00:46.770304319Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T10:35:16.464644Z"},{"id":"UBUNTU-CVE-2026-118019","description":"Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.","status":"published","published":"2026-10-27T14:16:00Z","modified":"2026-11-07T01:46:07.889430526Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"SUSE-SU-2026:5174-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nUpdate to Firefox Extended Support Release 153.7.0 ESR (MFSA 2026-127, bsc#1289275):\n\n- CVE-2026-118007: Use-after-free in the JavaScript: GC component.\n- CVE-2026-118019: Race condition, use-after-free in the DOM: File component.\n- CVE-2026-118021: Sandbox escape due to use-after-free in the XPCOM component.\n- CVE-2026-118024: Use-after-free in the Graphics: Text component.\n- CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component.\n- CVE-2026-124854: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-124855: Sandbox escape in the DOM: Navigation component.\n- CVE-2026-124856: Incorrect boundary conditions in the Networking: HTTP component.\n- CVE-2026-124857: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-124858: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-124859: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component.\n- CVE-2026-124860: Use-after-free in the Audio/Video component.\n- CVE-2026-124861: Sandbox escape due to use-after-free in the Audio/Video: cubeb component.\n- CVE-2026-124862: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-124863: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-124864: Sandbox escape due to use-after-free in the DOM: Service Workers component.\n- CVE-2026-124865: Use-after-free in the Audio/Video component.\n- CVE-2026-124866: Use-after-free in the Layout component.\n- CVE-2026-124868: Incorrect boundary conditions in the DOM: Core \u0026 HTML component.\n- CVE-2026-124869: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-124870: Incorrect boundary conditions in the JavaScript: GC component.\n- CVE-2026-124872: Use-after-free in the Cycle Collector component.\n- CVE-2026-124873: Invalid pointer in the DOM: Editor component.\n- CVE-2026-124874: Same-origin policy bypass in the Networking: HTTP component.\n- CVE-2026-124875: Incorrect boundary conditions in the DOM: CSS Object Model component.\n- CVE-2026-124876: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-124877: Use-after-free in the Layout: Positioned component.\n- CVE-2026-124879: Invalid pointer in the Networking: Cache component.\n- CVE-2026-124880: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-124881: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-124882: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-124883: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-124884: Use-after-free in the JavaScript: GC component.\n- CVE-2026-124885: Use-after-free in the Graphics: Text component.\n- CVE-2026-124886: Invalid pointer in the Layout: Text and Fonts component.\n- CVE-2026-124887: Incorrect boundary conditions in the Layout: Text and Fonts component.\n- CVE-2026-124888: Incorrect boundary conditions in the Layout: Text and Fonts component.\n- CVE-2026-124889: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-124890: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-124891: Incorrect boundary conditions in the DOM: Selection component.\n- CVE-2026-124892: Use-after-free in the JavaScript: GC component.\n- CVE-2026-124893: Use-after-free in the DOM: Workers component.\n- CVE-2026-124894: Use-after-free in the Networking: Cookies component.\n- CVE-2026-124895: Use-after-free in the Storage: localStorage \u0026 sessionStorage component.\n- CVE-2026-124896: Invalid pointer in the Layout: Text and Fonts component.\n- CVE-2026-124897: Use-after-free in the JavaScript: GC component.\n- CVE-2026-124898: Use-after-free in the DOM: Editor component.\n- CVE-2026-124899: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-124901: Other issue in the Networking: JAR component.\n- CVE-2026-124902: Same-origin policy bypass due to race condition in the Audio/Video component.\n- CVE-2026-124903: Sandbox escape due to use-after-free in the IPC component.\n- CVE-2026-124905: Sandbox escape in the DOM: Navigation component.\n- CVE-2026-124906: Use-after-free in the Graphics: WebRender component.\n- CVE-2026-124907: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-124909: Information disclosure in the Private Browsing component.\n- CVE-2026-124910: Mitigation bypass in the WebExtensions component.\n- CVE-2026-124912: Spoofing issue in the DOM: Security component.\n- CVE-2026-124913: Site isolation issue in the Networking component.\n- CVE-2026-124914: Site isolation issue in the DOM: Navigation component.\n- CVE-2026-124915: Incorrect boundary conditions in the Graphics: WebGPU component.\n- CVE-2026-124917: Sandbox escape due to use-after-free in the Widget: Gtk component.\n- CVE-2026-124918: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-124919: Privilege escalation due to use-after-free in the WebRTC: Networking component.\n- CVE-2026-124922: Use-after-free in the CSS Transitions and Animations component.\n- CVE-2026-124924: Incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-124926: Incorrect boundary conditions in the WebRTC component.\n- CVE-2026-124927: Site isolation issue in the Graphics: WebRender component.\n- CVE-2026-124929: Information disclosure in the Layout: Form Controls component.\n- CVE-2026-124930: Information disclosure in the Address Bar component.\n- CVE-2026-124931: Same-origin policy bypass in the DOM: Core \u0026 HTML component.\n- CVE-2026-124932: Use-after-free in the Graphics component.\n- CVE-2026-124933: Sandbox escape in the Console component.\n- CVE-2026-124934: Spoofing issue in the Security component.\n- CVE-2026-124935: Undefined behavior in the WebRTC: Networking component.\n- CVE-2026-124938: Mitigation bypass in the Add-ons Manager component.\n- CVE-2026-124939: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-124940: Mitigation bypass in the File Handling component.\n- CVE-2026-124941: Information disclosure in the Security: RLBox component.\n- CVE-2026-124942: Invalid pointer in the DOM: Streams component.\n- CVE-2026-124948: Incorrect boundary conditions, use-after-free in the Graphics component.\n- CVE-2026-124951: Privilege escalation in the Nimbus Desktop Client component.\n","status":"published","published":"2026-11-10T15:32:04Z","modified":"2026-11-11T13:00:04.417169657Z","updated_at":"2026-11-11T13:08:46.301371Z"}]}}