{"id":"CVE-2026-74989","aliases":["EUVD-2026-60700","GHSA-c9qh-jjjj-xhq4","SUSE-SU-2026:3658-1","SUSE-SU-2026:3683-1","UBUNTU-CVE-2026-74989","openSUSE-SU-2026:11580-1"],"status":"published","title":"Internally found bugs fixed in Firefox 154","description":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0057,"percentile":0.475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2026-08-18T12:23:41Z","modified":"2026-11-05T11:47:37Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-150200.152.251.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-112.327.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.14.0-112.327.1"}]}],"bundled":58},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0-0ubuntu0.22.04.1","102.12.0-0ubuntu0.22.04.1","102.13.0-0ubuntu0.22.04.1","102.15.1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.15.1-1","102.15.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["115.3.0-0ubuntu1","115.4.0-2","115.5.0-1","115.6.0-1","115.7.0-4","115.8.0-1","115.9.0-1","115.9.0-1build1","115.10.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"154.0-1.1"}]}],"bundled":58}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022257%2C2027351%2C2027380%2C2029289","tags":["Not Applicable"]},{"url":"https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027388%2C2029750%2C2029794%2C2043298%2C2045126%2C2049810%2C2051741","tags":["Not Applicable"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-74/","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-78/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74989"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-74"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-78"},{"url":"https://github.com/advisories/GHSA-c9qh-jjjj-xhq4"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263658-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274867","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75874","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263683-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-74989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74989","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74989","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-74989","title":"Internally found bugs fixed in Firefox 154","description":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.","status":"published","published":"2026-08-18T12:23:41.853Z","modified":"2026-10-28T16:36:02.55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:20:03.4818Z"}],"euvd":[{"id":"EUVD-2026-60700","description":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.","status":"published","published":"2026-08-18T12:23:41Z","modified":"2026-10-28T16:36:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:20.41252Z"}],"ghsa":[{"id":"GHSA-c9qh-jjjj-xhq4","title":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory...","description":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154.","status":"published","published":"2026-08-18T15:31:44Z","modified":"2026-08-20T18:30:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:10:47.133481Z"}],"nvd":[{"id":"CVE-2026-74989","description":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.","status":"published","published":"2026-08-18T13:17:40.81Z","modified":"2026-10-28T17:18:41.747Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:12:38.976695Z"}],"osv":[{"id":"UBUNTU-CVE-2026-74989","description":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.","status":"published","published":"2026-08-18T13:17:00Z","modified":"2026-11-05T11:47:37.38529337Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"openSUSE-SU-2026:11580-1","title":"MozillaFirefox-154.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaFirefox-154.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-23T00:00:00Z","modified":"2026-08-24T08:30:04.359325529Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:3658-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nUpdate to Firefox Extended Support Release 140.14.0 ESR.\n  \n- MFSA 2026-74 (bsc#1274867)\n  - CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component.\n  - CVE-2026-74935: Privilege escalation in the DOM: Networking component.\n  - CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component.\n  - CVE-2026-74937: Use-after-free in the JavaScript: GC component.\n  - CVE-2026-74938: Mitigation bypass in the JavaScript: GC component.\n  - CVE-2026-74939: Privilege escalation in the DOM: Navigation component.\n  - CVE-2026-74940: Use-after-free in the Graphics: Text component.\n  - CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component.\n  - CVE-2026-74942: Privilege escalation in the Remote Settings Client component.\n  - CVE-2026-74943: Use-after-free in the Graphics: ImageLib component.\n  - CVE-2026-74944: Use-after-free in the DOM: Core \u0026 HTML component.\n  - CVE-2026-74945: Information disclosure in the Graphics: Text component.\n  - CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n  - CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component.\n  - CVE-2026-74948: Information disclosure in the Graphics component.\n  - CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.\n  - CVE-2026-74950: Privilege escalation in the Downloads API component.\n  - CVE-2026-74951: Clickjacking issue in Firefox for Android.\n  - CVE-2026-74952: Privilege escalation in the Application Update component.\n  - CVE-2026-74953: Privilege escalation in the Networking: Cookies component.\n  - CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component.\n  - CVE-2026-74955: Privilege escalation in the Request Handling component.\n  - CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component.\n  - CVE-2026-74957: Mitigation bypass in the Safe Browsing component.\n  - CVE-2026-74958: Information disclosure in the WebRTC component.\n  - CVE-2026-74959: Mitigation bypass in the Storage: Cache API component.\n  - CVE-2026-74960: Site isolation issue in the WebExtensions component.\n  - CVE-2026-74961: Side-channel in the Web Audio component.\n  - CVE-2026-74962: Site isolation issue in the Networking: Cookies component.\n  - CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component.\n  - CVE-2026-74964: Integer overflow in the Graphics component.\n  - CVE-2026-74965: Privilege escalation in the Shell Integration component.\n  - CVE-2026-74966: Information disclosure in the Form Autofill component.\n  - CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component.\n  - CVE-2026-74968: Site isolation issue in the Graphics: WebRender component.\n  - CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component.\n  - CVE-2026-74970: Site isolation issue in the Graphics component.\n  - CVE-2026-74971: Information disclosure in the DOM: UI Events \u0026 Focus Handling component.\n  - CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component.\n  - CVE-2026-74973: Race condition, use-after-free in the Graphics component.\n  - CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component.\n  - CVE-2026-74975: Spoofing issue in the Downloads component in Firefox for Android.\n  - CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component.\n  - CVE-2026-74977: Integer overflow in the Graphics component.\n  - CVE-2026-74978: Clickjacking issue in the Widget component.\n  - CVE-2026-74979: Mitigation bypass in the Add-ons Manager component.\n  - CVE-2026-74980: Clickjacking issue in the Downloads component in Firefox for Android.\n  - CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component.\n  - CVE-2026-74982: Denial-of-service in the Widget component.\n  - CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component.\n  - CVE-2026-74984: Race condition in the JavaScript Engine component.\n  - CVE-2026-74985: Privilege escalation in the Enterprise Policies component.\n  - CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component.\n  - CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154.\n  - CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154.\n  - CVE-2026-74989: Internally found bugs fixed in Firefox 154.\n  - CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and\n    Firefox 154.\n  - CVE-2026-75874: Sandbox escape in the Remote Settings Client component.\n","status":"published","published":"2026-08-20T17:16:18Z","modified":"2026-08-21T09:15:05.934592615Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3683-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nUpdate to Firefox Extended Support Release 140.14.0 ESR.\n\n- MFSA 2026-74 (bsc#1274867):\n  - CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component.\n  - CVE-2026-74935: Privilege escalation in the DOM: Networking component.\n  - CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component.\n  - CVE-2026-74937: Use-after-free in the JavaScript: GC component.\n  - CVE-2026-74938: Mitigation bypass in the JavaScript: GC component.\n  - CVE-2026-74939: Privilege escalation in the DOM: Navigation component.\n  - CVE-2026-74940: Use-after-free in the Graphics: Text component.\n  - CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component.\n  - CVE-2026-74942: Privilege escalation in the Remote Settings Client component.\n  - CVE-2026-74943: Use-after-free in the Graphics: ImageLib component.\n  - CVE-2026-74944: Use-after-free in the DOM: Core \u0026 HTML component.\n  - CVE-2026-74945: Information disclosure in the Graphics: Text component.\n  - CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n  - CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component.\n  - CVE-2026-74948: Information disclosure in the Graphics component.\n  - CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.\n  - CVE-2026-74950: Privilege escalation in the Downloads API component.\n  - CVE-2026-74951: Clickjacking issue in Firefox for Android.\n  - CVE-2026-74952: Privilege escalation in the Application Update component.\n  - CVE-2026-74953: Privilege escalation in the Networking: Cookies component.\n  - CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component.\n  - CVE-2026-74955: Privilege escalation in the Request Handling component.\n  - CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component.\n  - CVE-2026-74957: Mitigation bypass in the Safe Browsing component.\n  - CVE-2026-74958: Information disclosure in the WebRTC component.\n  - CVE-2026-74959: Mitigation bypass in the Storage: Cache API component.\n  - CVE-2026-74960: Site isolation issue in the WebExtensions component.\n  - CVE-2026-74961: Side-channel in the Web Audio component.\n  - CVE-2026-74962: Site isolation issue in the Networking: Cookies component.\n  - CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component.\n  - CVE-2026-74964: Integer overflow in the Graphics component.\n  - CVE-2026-74965: Privilege escalation in the Shell Integration component.\n  - CVE-2026-74966: Information disclosure in the Form Autofill component.\n  - CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component.\n  - CVE-2026-74968: Site isolation issue in the Graphics: WebRender component.\n  - CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component.\n  - CVE-2026-74970: Site isolation issue in the Graphics component.\n  - CVE-2026-74971: Information disclosure in the DOM: UI Events \u0026 Focus Handling component.\n  - CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component.\n  - CVE-2026-74973: Race condition, use-after-free in the Graphics component.\n  - CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component.\n  - CVE-2026-74975: Spoofing issue in the Downloads component in Firefox for Android.\n  - CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component.\n  - CVE-2026-74977: Integer overflow in the Graphics component.\n  - CVE-2026-74978: Clickjacking issue in the Widget component.\n  - CVE-2026-74979: Mitigation bypass in the Add-ons Manager component.\n  - CVE-2026-74980: Clickjacking issue in the Downloads component in Firefox for Android.\n  - CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component.\n  - CVE-2026-74982: Denial-of-service in the Widget component.\n  - CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component.\n  - CVE-2026-74984: Race condition in the JavaScript Engine component.\n  - CVE-2026-74985: Privilege escalation in the Enterprise Policies component.\n  - CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component.\n  - CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154.\n  - CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154.\n  - CVE-2026-74989: Internally found bugs fixed in Firefox 154.\n  - CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and\n    Firefox 154.\n  - CVE-2026-75874: Sandbox escape in the Remote Settings Client component.\n","status":"published","published":"2026-08-21T18:21:16Z","modified":"2026-08-26T18:23:32.608821695Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}