This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):
- CVE-2026-109704: Privilege escalation in the Application Update component.
- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the
Networking component.
- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
- CVE-2026-109709: Information disclosu
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 153.4.0 ESR (MFSA 2026-100, bsc#1282929):
- CVE-2026-96869: Information disclosure in the Networking component.
- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component.
- CVE-2026-100757: Use-after-free in the Widget component.
- CVE-2026-100758: Sandbox escape in the DOM: Navigation component.
- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component.
- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-100762: Sandbox escape due to use-after-free
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 153.3.0 ESRi (MFSA 2026-93, bsc#1280371)
- CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component.
- CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
- CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
- CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
- CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in th
Security update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen
This update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues:
Changes in MozillaFirefox:
This update ships Firefox Extended Support Release 153.2.0 ESR
* Fixed: Various security fixes.
MFSA 2026-85 (bsc#1278001):
* CVE-2026-75874: Sandbox escape in the Remote Settings Client component
* CVE-2026-84118: Use-after-free in the JavaScript: GC component
* CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation
component
* CVE-2026-84120: Use-after-free in the Audio/Video component
* CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security
component
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.14.0 ESR.
- MFSA 2026-74 (bsc#1274867):
- CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component.
- CVE-2026-74935: Privilege escalation in the DOM: Networking component.
- CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component.
- CVE-2026-74937: Use-after-free in the JavaScript: GC component.
- CVE-2026-74938: Mitigation bypass in the JavaScript: GC component.
- CVE-2026-74939: Privilege escalation in the DOM: Navigation component.
- CVE-2026-74940: Use-after-free in the Graphics: Tex
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 140.13.0 ESR (MFSA 2026-70, bsc#1271649):
- CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component.
- CVE-2026-15719: Site isolation issue in the DOM: Navigation component.
- CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component.
- CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component.
- CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component.
- CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component.
- CVE-2026-1635
This update for MozillaFirefox fixes the following issues:
Update to Firefox 140.12.0 ESR (MFSA 2026-58, bsc#1268071):
- CVE-2026-12289: Privilege escalation in the Graphics: WebRender component.
- CVE-2026-12290: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12291: Use-after-free in the Networking: HTTP component.
- CVE-2026-12292: Incorrect boundary conditions in the Web Audio component.
- CVE-2026-12294: Sandbox escape in the DOM: Workers component.
- CVE-2026-12295: Sandbox escape in the DOM: Navigation component.
- CVE-2026-12296: Sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-12297: Sandbox escape
This update for MozillaFirefox fixes the following issues:
Update to Firefox 140.9.0 ESR (MFSA 2026-22, bsc#1260083):
- CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component
- CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component
- CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.8.0 ESR (MFSA 2026-15) (bsc#1258568):
- CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component
- CVE-2026-2758: Use-after-free in the JavaScript: GC component
- CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib component
- CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
- CVE-2026-2762: Integer overflow in the JavaScript: Standard Library component
- CVE-2026-2763:
This update for MozillaFirefox fixes the following issues:
- Update to Firefox 140.7.1 ESR
- CVE-2026-2447: Fixed a heap buffer overflow in libvpx. (bsc#1258231)
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.7.0 ESR (bsc#1256340).
- MFSA 2026-03
* CVE-2026-0877: Mitigation bypass in the DOM: Security component
* CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
* CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the Graphics component
* CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics component
* CVE-2026-0882: Use-after-free in the IPC component
* CVE-2025-14327: Spoofing issue in the Downloads Panel component
* CVE-2026-0883:
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.6.0 ESR (bsc#1254551).
- MFSA 2025-94
* CVE-2025-14321: use-after-free in the WebRTC: Signaling component.
* CVE-2025-14322: sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
* CVE-2025-14323: privilege escalation in the DOM: Notifications component.
* CVE-2025-14324: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14325: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14328: privilege escalation in the Netmonitor component.
* CVE-20
This update for MozillaFirefox fixes the following issues:
- Update to Firefox Extended Support Release 140.5.0 ESR (bsc#1253188)
- CVE-2025-13012: Race condition in the Graphics component.
- CVE-2025-13016: Incorrect boundary conditions in the JavaScript: WebAssembly component.
- CVE-2025-13017: Same-origin policy bypass in the DOM: Notifications component.
- CVE-2025-13018: Mitigation bypass in the DOM: Security component.
- CVE-2025-13019: Same-origin policy bypass in the DOM: Workers component.
- CVE-2025-13013: Mitigation bypass in the DOM: Core & HTML component.
- CVE-2025-13020: Use-after-free in the WebRTC: Audio/Video component.
- C
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.4.0 ESR (bsc#1251263).
- CVE-2025-11708: Use-after-free in MediaTrackGraphImpl::GetInstance()
- CVE-2025-11709: Out of bounds read/write in a privileged process triggered by WebGL textures
- CVE-2025-11710: Cross-process information leaked due to malicious IPC messages
- CVE-2025-11711: Some non-writable Object properties could be modified
- CVE-2025-11712: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type
- CVE-2025-11713: Potential user-assisted code execution in “Copy as cURL” command
- CV
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.3.1 ESR (bsc#1250452).
- Improved reliability when HTTP/3 connections fail: Firefox no longer forces HTTP/2 during fallback, allowing the
server to choose the protocol and preventing stalls on some sites.
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 140.2.0 ESR
MFSA 2025-67 (bsc#1248162)
* CVE-2025-9179 (bmo#1979527):
Sandbox escape due to invalid pointer in the Audio/Video: GMP
component
* CVE-2025-9180 (bmo#1979782):
Same-origin policy bypass in the Graphics: Canvas2D component
* CVE-2025-9181 (bmo#1977130):
Uninitialized memory in the JavaScript Engine component
* CVE-2025-9182 (bmo#1975837):
Denial-of-service due to out-of-memory in the Graphics:
WebRender component
* CVE-2025-9183 (bmo#1976102):
Spoofing issue in the Address Bar component
* CVE-202
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 140.1.0 ESR
* MFSA-RESERVE-2025-1968423 (bmo#1968423)
JavaScript engine only wrote partial return value to stack
* MFSA-RESERVE-2025-1971581 (bmo#1971581)
Large branch table could lead to truncated instruction
* MFSA-RESERVE-2025-1928021 (bmo#1928021)
CSP does not block javascript: URLs on object and embed tags
* MFSA-RESERVE-2025-1960834 (bmo#1960834)
DNS rebinding circumvents CORS
* MFSA-RESERVE-2025-1964767 (bmo#1964767)
Nameless cookies shadow secure cookies
* MFSA-RESERVE-2025-1968414 (bmo#1968414)
Potential
Security update for MozillaFirefox, MozillaFirefox-branding-SLE
This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:
This is the Firefox Extended Support Release 140.0esr ESR
Major changes:
General:
- Reader View now has an enhanced Text and Layout menu with
new options for character spacing, word spacing, and text
alignment. These changes offer a more accessible reading
experience.
- Reader View now has a Theme menu with additional Contrast
and Gray options. You can also select custom colors for text,
background, and links from the Custom tab.
- Firefox will now offer to temporarily remember when users
grant permissions to sites (e.g. g