MGASA-2026-0145: firefox Mageia
CVSS: UnknownPublished
Published 16-05-2026Last modified 16-05-2026
Vulnerability summary
MGASA-2026-0145 is a vulnerability in firefox Mageia with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 7 · Downstream 0Timeline
- 16-05-2026PublishedVulnerability first disclosed.
- 16-05-2026Last modifiedVulnerability information updated.
Description
Updated firefox & thunderbird packages fix security vulnerabilities LZ4 compression library issue. (CVE-2025-62813) libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. (CVE-2026-32776) libexpat before 2.7.5 allows an infinite loop while parsing DTD content. (CVE-2026-32777) libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. (CVE-2026-32778) Use-after-free in the DOM: Networking component. (CVE-2026-8090) Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2, Firefox 150.0.2, Thunderbird ESR 140.10.2 and Thunderbird 150.0.2. (CVE-2026-8092) Another issue in the WebRTC component. (CVE-2026-8094)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia4 products
- firefox< 140.10.2-1.mga9
- firefox-l10n< 140.10.2-1.mga9
- thunderbird< 140.10.2-1.mga9
- thunderbird-l10n< 140.10.2-1.mga9
1 vendor · 4 products
References
6 linksRelated vulnerabilities
MGASA-2026-0449mageiathunderbird+3Updated thunderbird & thunderbird-l10n packages fix security vulnerabilities
Ambiguous parsing of mail headers. (CVE-2026-92238)
Buffer overrun in IMAP. (CVE-2026-92239)
Out-of-bounds read in IMAP response parser. (CVE-2026-92240)
Use-after-free in the Audio/Video: Web Codecs component.
(CVE-2026-92005)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92006)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92007)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92008)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92009)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92010)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92011)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92012)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92013)
Privilege escalation due to incorrect boundary conditions in the
Graphics component. (CVE-2026-92014)
Privilege escalation in the WebExtensions component. (CVE-2026-92015)
Use-after-free in the Disability Access APIs component. (CVE-2026-92016)
Privilege escalation in the DOM: Service Workers component.
(CVE-2026-92017)
Sandbox escape in the DOM: Core & HTML component. (CVE-2026-92018)
Mitigation bypass in the Remote Settings Client component.
(CVE-2026-92019)
Privilege escalation due to incorrect boundary conditions in the
Graphics: WebRender component. (CVE-2026-92020)
Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-92021)
Use-after-free in the DOM: HTML Parser component. (CVE-2026-92022)
Use-after-free in the XML component. (CVE-2026-92023)
Use-after-free in the SVG component. (CVE-2026-92024)
Use-after-free in the DOM: Navigation component. (CVE-2026-92025)
Use-after-free in the Networking component. (CVE-2026-92026)
Use-after-free in the DOM: Streams component. (CVE-2026-92027)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-92028)
Use-after-free in the SVG component. (CVE-2026-92029)
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.
(CVE-2026-92030)
Information disclosure in the Graphics: ImageLib component.
(CVE-2026-92031)
Sandbox escape due to invalid pointer in the Graphics component.
(CVE-2026-92032)
Mitigation bypass in the Remote Settings Client component.
(CVE-2026-92038)
Mitigation bypass in the DOM: Notifications component. (CVE-2026-92039)
Mitigation bypass in the DOM: Networking component. (CVE-2026-92041)
Race condition in the DOM: Content Processes component. (CVE-2026-92042)
Privilege escalation due to incorrect boundary conditions in the
Audio/Video component. (CVE-2026-92043)
Information disclosure in the Networking: HTTP component.
(CVE-2026-92044)
Sandbox escape due to incorrect boundary conditions in the WebRTC
component. (CVE-2026-92045)
Use-after-free in the Graphics component. (CVE-2026-92046)
Privilege escalation in the Crash Reporting component. (CVE-2026-92047)
Privilege escalation due to uninitialized memory in the Graphics:
CanvasWebGL component. (CVE-2026-92052)
Privilege escalation in the Graphics: CanvasWebGL component.
(CVE-2026-92053)
Privilege escalation in the Memory component. (CVE-2026-92054)
Privilege escalation in the DevTools component. (CVE-2026-92055)
Use-after-free in the Graphics: Text component. (CVE-2026-92056)
Mitigation bypass in the Enterprise Policies component. (CVE-2026-92057)
Use-after-free in the Graphics component. (CVE-2026-92058)
Incorrect boundary conditions in the DOM: Editor component.
(CVE-2026-92059)
Use-after-free in the Internationalization component. (CVE-2026-92060)
Privilege escalation in the Session Restore component. (CVE-2026-92062)
Use-after-free in the Widget: Gtk component. (CVE-2026-92067)
Site isolation issue in the Reader Mode component. (CVE-2026-92068)
Spoofing issue in the DOM: Navigation component. (CVE-2026-92069)
Information disclosure in the Networking component. (CVE-2026-92070)
Incorrect boundary conditions in the Safe Browsing component.
(CVE-2026-92072)
Privilege escalation in the Enterprise Policies component.
(CVE-2026-92073)
Mitigation bypass in the Popup Blocker component. (CVE-2026-92074)
Mitigation bypass in the Networking component. (CVE-2026-92075)
Incorrect boundary conditions in the Networking component.
(CVE-2026-92076)
Denial-of-service in the SVG component. (CVE-2026-92077)
Denial-of-service in the Security component. (CVE-2026-92078)MGASA-2026-0441mageiafirefox+5Updated nss & firefox packages fix security vulnerabilities
Use-after-free in the Audio/Video: Web Codecs component.
(CVE-2026-92005)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92006)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92007)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92008)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92009)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92010)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92011)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92012)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92013)
Privilege escalation due to incorrect boundary conditions in the
Graphics component. (CVE-2026-92014)
Privilege escalation in the WebExtensions component. (CVE-2026-92015)
Use-after-free in the Disability Access APIs component. (CVE-2026-92016)
Privilege escalation in the DOM: Service Workers component.
(CVE-2026-92017)
Sandbox escape in the DOM: Core & HTML component. (CVE-2026-92018)
Mitigation bypass in the Remote Settings Client component.
(CVE-2026-92019)
Privilege escalation due to incorrect boundary conditions in the
Graphics: WebRender component. (CVE-2026-92020)
Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-92021)
Use-after-free in the DOM: HTML Parser component. (CVE-2026-92022)
Use-after-free in the XML component. (CVE-2026-92023)
Use-after-free in the SVG component. (CVE-2026-92024)
Use-after-free in the DOM: Navigation component. (CVE-2026-92025)
Use-after-free in the Networking component. (CVE-2026-92026)
Use-after-free in the DOM: Streams component. (CVE-2026-92027)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-92028)
Use-after-free in the SVG component. (CVE-2026-92029)
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.
(CVE-2026-92030)
Information disclosure in the Graphics: ImageLib component.
(CVE-2026-92031)
Sandbox escape due to invalid pointer in the Graphics component.
(CVE-2026-92032)
Mitigation bypass in the Remote Settings Client component.
(CVE-2026-92038)
Mitigation bypass in the DOM: Notifications component. (CVE-2026-92039)
Mitigation bypass in the DOM: Networking component. (CVE-2026-92041)
Race condition in the DOM: Content Processes component. (CVE-2026-92042)
Privilege escalation due to incorrect boundary conditions in the
Audio/Video component. (CVE-2026-92043)
Information disclosure in the Networking: HTTP component.
(CVE-2026-92044)
Sandbox escape due to incorrect boundary conditions in the WebRTC
component. (CVE-2026-92045)
Use-after-free in the Graphics component. (CVE-2026-92046)
Privilege escalation in the Crash Reporting component. (CVE-2026-92047)
Privilege escalation due to uninitialized memory in the Graphics:
CanvasWebGL component. (CVE-2026-92052)
Privilege escalation in the Graphics: CanvasWebGL component.
(CVE-2026-92053)
Privilege escalation in the Memory component. (CVE-2026-92054)
Privilege escalation in the DevTools component. (CVE-2026-92055)
Use-after-free in the Graphics: Text component. (CVE-2026-92056)
Mitigation bypass in the Enterprise Policies component. (CVE-2026-92057)
Use-after-free in the Graphics component. (CVE-2026-92058)
Incorrect boundary conditions in the DOM: Editor component.
(CVE-2026-92059)
Use-after-free in the Internationalization component. (CVE-2026-92060)
Privilege escalation in the Session Restore component. (CVE-2026-92062)
Use-after-free in the Widget: Gtk component. (CVE-2026-92067)
Site isolation issue in the Reader Mode component. (CVE-2026-92068)
Spoofing issue in the DOM: Navigation component. (CVE-2026-92069)
Information disclosure in the Networking component. (CVE-2026-92070)
Incorrect boundary conditions in the Safe Browsing component.
(CVE-2026-92072)
Privilege escalation in the Enterprise Policies component.
(CVE-2026-92073)
Mitigation bypass in the Popup Blocker component. (CVE-2026-92074)
Mitigation bypass in the Networking component. (CVE-2026-92075)
Incorrect boundary conditions in the Networking component.
(CVE-2026-92076)
Denial-of-service in the SVG component. (CVE-2026-92077)
Denial-of-service in the Security component. (CVE-2026-92078)MGASA-2026-0388mageiathunderbird+3Updated thunderbird packages fix security vulnerabilities
Uninitialized memory in MIME parsing. (CVE-2026-84639)
One byte overflow read in mail parser. (CVE-2026-84640)
Information disclosure due to malicious IMAP server response.
(CVE-2026-84641)
Calendar invitation attachments could launch local executables.
(CVE-2026-84637)
Allowed UNC hostnames for attachments interpreted as a regular
expression. (CVE-2026-84642)
Sandbox escape in the Remote Settings Client component. (CVE-2026-75874)
Privilege escalation in the DOM: Workers component. (CVE-2026-16365)
Use-after-free in the JavaScript: GC component. (CVE-2026-84118)
Sandbox escape due to use-after-free in the DOM: Navigation component.
(CVE-2026-84119)
Use-after-free in the Audio/Video component. (CVE-2026-84120)
Sandbox escape due to use-after-free in the DOM: Security component.
(CVE-2026-84121)
Use-after-free in the Audio/Video component. (CVE-2026-84122)
Privilege escalation due to use-after-free in the Graphics: WebGPU
component. (CVE-2026-84123)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125)
Privilege escalation in the DOM: Navigation component. (CVE-2026-16371)
Privilege escalation in the Application Update component.
(CVE-2026-74952)
Site isolation issue in the DOM: Navigation component. (CVE-2026-84129)
Information disclosure in the Graphics: WebGPU component.
(CVE-2026-84130)
Privilege escalation due to invalid pointer in the Graphics component.
(CVE-2026-84131)
Information disclosure in the Networking: HTTP component.
(CVE-2026-84132)
Site isolation issue in the DOM: Push Subscriptions component.
(CVE-2026-84133)
Other issue in the Profile Backup component. (CVE-2026-84134)
Other issue in the DOM: Navigation component. (CVE-2026-84136)
Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137)
Clickjacking issue in the DOM: Events component. (CVE-2026-84139)
Site isolation issue in the DOM: Navigation component. (CVE-2026-84140)
Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141)
Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2
and Thunderbird ESR 140.15. (CVE-2026-84143)
Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR
153.2. (CVE-2026-84144)
Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2
and Thunderbird ESR 140.15. (CVE-2026-84145)MGASA-2026-0387mageiafirefox+5Updated firefox & nss packages fix security vulnerabilities
Sandbox escape in the Remote Settings Client component. (CVE-2026-75874)
Privilege escalation in the DOM: Workers component. (CVE-2026-16365)
Use-after-free in the JavaScript: GC component. (CVE-2026-84118)
Sandbox escape due to use-after-free in the DOM: Navigation component.
(CVE-2026-84119)
Use-after-free in the Audio/Video component. (CVE-2026-84120)
Sandbox escape due to use-after-free in the DOM: Security component.
(CVE-2026-84121)
Use-after-free in the Audio/Video component. (CVE-2026-84122)
Privilege escalation due to use-after-free in the Graphics: WebGPU
component. (CVE-2026-84123)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125)
Privilege escalation in the DOM: Navigation component. (CVE-2026-16371)
Privilege escalation in the Application Update component.
(CVE-2026-74952)
Site isolation issue in the DOM: Navigation component. (CVE-2026-84129)
Information disclosure in the Graphics: WebGPU component.
(CVE-2026-84130)
Privilege escalation due to invalid pointer in the Graphics component.
(CVE-2026-84131)
Information disclosure in the Networking: HTTP component.
(CVE-2026-84132)
Site isolation issue in the DOM: Push Subscriptions component.
(CVE-2026-84133)
Other issue in the Profile Backup component. (CVE-2026-84134)
Other issue in the DOM: Navigation component. (CVE-2026-84136)
Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137)
Clickjacking issue in the DOM: Events component. (CVE-2026-84139)
Site isolation issue in the DOM: Navigation component. (CVE-2026-84140)
Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141)
Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and
Firefox ESR 140.15. (CVE-2026-84143)
Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2.
(CVE-2026-84144)
Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox
ESR 140.15 and Firefox ESR 115.40. (CVE-2026-84145)MGASA-2026-0346mageiathunderbird+3Updated thunderbird packages fix security vulnerabilities
Site isolation issue in the Graphics: CanvasWebGL component.
(CVE-2026-74934)
Privilege escalation in the DOM: Networking component. (CVE-2026-74935)
Use-after-free in the JavaScript: WebAssembly component.
(CVE-2026-74936)
Use-after-free in the JavaScript: GC component. (CVE-2026-74937)
Mitigation bypass in the JavaScript: GC component. (CVE-2026-74938)
Privilege escalation in the DOM: Navigation component. (CVE-2026-74939)
Use-after-free in the Graphics: Text component. (CVE-2026-74940)
Privilege escalation in the Graphics: CanvasWebGL component.
(CVE-2026-74941)
Privilege escalation in the Remote Settings Client component.
(CVE-2026-74942)
Use-after-free in the Graphics: ImageLib component. (CVE-2026-74943)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-74944)
Information disclosure in the Graphics: Text component. (CVE-2026-74945)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-74946)
Privilege escalation due to invalid pointer in the Graphics component.
(CVE-2026-74947)
Information disclosure in the Graphics component. (CVE-2026-74948)
Privilege escalation in the Downloads API component. (CVE-2026-74950)
Privilege escalation in the Networking: Cookies component.
(CVE-2026-74953)
Information disclosure due to side-channel in the Storage: Cache API
component. (CVE-2026-74954)
Privilege escalation in the Request Handling component. (CVE-2026-74955)
Same-origin policy bypass in the DOM: Service Workers component.
(CVE-2026-74956)
Mitigation bypass in the Safe Browsing component. (CVE-2026-74957)
Information disclosure in the WebRTC component. (CVE-2026-74958)
Mitigation bypass in the Storage: Cache API component. (CVE-2026-74959)
Site isolation issue in the WebExtensions component. (CVE-2026-74960)
Side-channel in the Web Audio component. (CVE-2026-74961)
Site isolation issue in the Networking: Cookies component.
(CVE-2026-74962)
Same-origin policy bypass in the Networking: Cookies component.
(CVE-2026-74963)
Integer overflow in the Graphics component. (CVE-2026-74964)
Privilege escalation in the Shell Integration component.
(CVE-2026-74965)
Information disclosure in the Form Autofill component. (CVE-2026-74966)
Same-origin policy bypass in the Audio/Video: Playback component.
(CVE-2026-74967)
Site isolation issue in the Graphics: WebRender component.
(CVE-2026-74968)
Use-after-free in the Layout: Text and Fonts component. (CVE-2026-74969)
Site isolation issue in the Graphics component. (CVE-2026-74970)
Information disclosure in the DOM: UI Events & Focus Handling component.
(CVE-2026-74971)
Information disclosure in the DOM: Push Subscriptions component.
(CVE-2026-74972)
Use-after-free in the Graphics: Canvas2D component. (CVE-2026-74949)
Race condition, use-after-free in the Graphics component.
(CVE-2026-74973)
Same-origin policy bypass in the Graphics: ImageLib component.
(CVE-2026-74974)
JIT miscompilation in the JavaScript Engine: JIT component.
(CVE-2026-74976)
Integer overflow in the Graphics component. (CVE-2026-74977)
Clickjacking issue in the Widget component. (CVE-2026-74978)
Mitigation bypass in the Add-ons Manager component. (CVE-2026-74979)
Site isolation issue in the Audio/Video: Web Codecs component.
(CVE-2026-74981)
Denial-of-service in the Widget component. (CVE-2026-74982)
Mitigation bypass in the Data Loss Prevention component.
(CVE-2026-74983)
Race condition in the JavaScript Engine component. (CVE-2026-74984)
Privilege escalation in the Enterprise Policies component.
(CVE-2026-74985)
Site isolation issue in the CSS Parsing and Computation component.
(CVE-2026-74986)
Internally found bugs fixed in Thunderbird ESR 140.14,
Thunderbird ESR 153.1 and Thunderbird 154. (CVE-2026-74987)
Internally found bugs fixed in Thunderbird ESR 153.1 and Thunderbird 154
(CVE-2026-74988)
Internally found bugs fixed in Thunderbird ESR 140.14,
Thunderbird ESR 153.1 and Thunderbird 154. (CVE-2026-74990)MGASA-2026-0345mageiafirefox+7Updated nspr, nss, & firefox packages fix security vulnerabilities
Site isolation issue in the Graphics: CanvasWebGL component.
(CVE-2026-74934)
Privilege escalation in the DOM: Networking component. (CVE-2026-74935)
Use-after-free in the JavaScript: WebAssembly component.
(CVE-2026-74936)
Use-after-free in the JavaScript: GC component. (CVE-2026-74937)
Mitigation bypass in the JavaScript: GC component. (CVE-2026-74938)
Privilege escalation in the DOM: Navigation component. (CVE-2026-74939)
Use-after-free in the Graphics: Text component. (CVE-2026-74940)
Privilege escalation in the Graphics: CanvasWebGL component.
(CVE-2026-74941)
Privilege escalation in the Remote Settings Client component.
(CVE-2026-74942)
Use-after-free in the Graphics: ImageLib component. (CVE-2026-74943)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-74944)
Information disclosure in the Graphics: Text component. (CVE-2026-74945)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-74946)
Privilege escalation due to invalid pointer in the Graphics component.
(CVE-2026-74947)
Information disclosure in the Graphics component. (CVE-2026-74948)
Privilege escalation in the Downloads API component. (CVE-2026-74950)
Privilege escalation in the Networking: Cookies component.
(CVE-2026-74953)
Information disclosure due to side-channel in the Storage: Cache API
component. (CVE-2026-74954)
Privilege escalation in the Request Handling component. (CVE-2026-74955)
Same-origin policy bypass in the DOM: Service Workers component.
(CVE-2026-74956)
Mitigation bypass in the Safe Browsing component. (CVE-2026-74957)
Information disclosure in the WebRTC component. (CVE-2026-74958)
Mitigation bypass in the Storage: Cache API component. (CVE-2026-74959)
Site isolation issue in the WebExtensions component. (CVE-2026-74960)
Side-channel in the Web Audio component. (CVE-2026-74961)
Site isolation issue in the Networking: Cookies component.
(CVE-2026-74962)
Same-origin policy bypass in the Networking: Cookies component.
(CVE-2026-74963)
Integer overflow in the Graphics component. (CVE-2026-74964)
Privilege escalation in the Shell Integration component.
(CVE-2026-74965)
Information disclosure in the Form Autofill component. (CVE-2026-74966)
Same-origin policy bypass in the Audio/Video: Playback component.
(CVE-2026-74967)
Site isolation issue in the Graphics: WebRender component.
(CVE-2026-74968)
Use-after-free in the Layout: Text and Fonts component. (CVE-2026-74969)
Site isolation issue in the Graphics component. (CVE-2026-74970)
Information disclosure in the DOM: UI Events & Focus Handling component.
(CVE-2026-74971)
Information disclosure in the DOM: Push Subscriptions component.
(CVE-2026-74972)
Use-after-free in the Graphics: Canvas2D component. (CVE-2026-74949)
Race condition, use-after-free in the Graphics component.
(CVE-2026-74973)
Same-origin policy bypass in the Graphics: ImageLib component.
(CVE-2026-74974)
JIT miscompilation in the JavaScript Engine: JIT component.
(CVE-2026-74976)
Integer overflow in the Graphics component. (CVE-2026-74977)
Clickjacking issue in the Widget component. (CVE-2026-74978)
Mitigation bypass in the Add-ons Manager component. (CVE-2026-74979)
Site isolation issue in the Audio/Video: Web Codecs component.
(CVE-2026-74981)
Denial-of-service in the Widget component. (CVE-2026-74982)
Mitigation bypass in the Data Loss Prevention component.
(CVE-2026-74983)
Race condition in the JavaScript Engine component. (CVE-2026-74984)
Privilege escalation in the Enterprise Policies component.
(CVE-2026-74985)
Site isolation issue in the CSS Parsing and Computation component.
(CVE-2026-74986)
Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and
Firefox 154. (CVE-2026-74987)
Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154.
(CVE-2026-74988)
Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and
Firefox 154. (CVE-2026-74990)