{"schemaVersion":3,"id":"OPENSUSE-SU-2026:21853-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for MozillaFirefox\n\nThis update for MozillaFirefox fixes the following issues:\n\nFirefox Extended Support Release 153.2.0 ESR MFSA 2026-85 (bsc#1278001):\n\n * CVE-2026-75874 (bmo#2039972)\n Sandbox escape in the Remote Settings Client component\n * CVE-2026-84118 (bmo#2057457)\n Use-after-free in the JavaScript: GC component\n * CVE-2026-84119 (bmo#2057817)\n Sandbox escape due to use-after-free in the DOM: Navigation\n component\n * CVE-2026-84120 (bmo#2058911)\n Use-after-free in the Audio/Video component\n * CVE-2026-84121 (bmo#2059018)\n Sandbox escape due to use-after-free in the DOM: Security\n * CVE-2026-84122 (bmo#2059965)\n * CVE-2026-84123 (bmo#2060047)\n Privilege escalation due to use-after-free in the Graphics:\n WebGPU component\n * CVE-2026-84124 (bmo#2061110)\n Use-after-free in the DOM: Core & HTML component\n * CVE-2026-84125 (bmo#2063871)\n * CVE-2026-74952 (bmo#2021757)\n Privilege escalation in the Application Update component\n * CVE-2026-84129 (bmo#2055028)\n Site isolation issue in the DOM: Navigation component\n * CVE-2026-84130 (bmo#2057834)\n Information disclosure in the Graphics: WebGPU component\n * CVE-2026-84131 (bmo#2060008)\n Privilege escalation due to invalid pointer in the Graphics\n * CVE-2026-84132 (bmo#2063020)\n Information disclosure in the Networking: HTTP component\n * CVE-2026-84133 (bmo#2032388)\n Site isolation issue in the DOM: Push Subscriptions component\n * CVE-2026-84134 (bmo#2044882)\n Other issue in the Profile Backup component\n * CVE-2026-84136 (bmo#2048699)\n Other issue in the DOM: Navigation component\n * CVE-2026-84137 (bmo#2051146)\n Spoofing issue in the DOM: Core & HTML component\n * CVE-2026-84139 (bmo#2060153)\n Clickjacking issue in the DOM: Events component\n * CVE-2026-84140 (bmo#2063780)\n * CVE-2026-84141 (bmo#2063994)\n Integer overflow in the Graphics: ImageLib component\n * CVE-2026-84143 (bmo#2048793, bmo#2054631, bmo#2054645,\n bmo#2054657, bmo#2055007, bmo#2055681, bmo#2057107,\n bmo#2057108, bmo#2057114, bmo#2058087, bmo#2058088,\n bmo#2058090, bmo#2058095, bmo#2058101, bmo#2059109,\n bmo#2059183, bmo#2059185, bmo#2061287, bmo#2061301,\n bmo#2061325)\n Internally found bugs fixed in Firefox 155, Firefox ESR 153.2\n and Firefox ESR 140.15\n * CVE-2026-84144 (bmo#2054619, bmo#2054620, bmo#2054624,\n bmo#2054625, bmo#2054691, bmo#2054702, bmo#2054726,\n bmo#2054775, bmo#2055703, bmo#2058006, bmo#2058013,\n bmo#2058085, bmo#2058098, bmo#2058627, bmo#2058661,\n bmo#2059002, bmo#2059127, bmo#2059128, bmo#2059144,\n bmo#2059180, bmo#2059191, bmo#2059192, bmo#2059199,\n bmo#2059205, bmo#2061320, bmo#2061430, bmo#2061495,\n bmo#2061505, bmo#2061521, bmo#2061532, bmo#2061775,\n bmo#2061799, bmo#2062395, bmo#2062404)\n Internally found bugs fixed in Firefox 155 and Firefox ESR\n 153.2\n * CVE-2026-84145 (bmo#2054640, bmo#2054650, bmo#2054652,\n bmo#2055678, bmo#2055693, bmo#2055705, bmo#2058001,\n bmo#2058051, bmo#2058652, bmo#2058660, bmo#2059027,\n bmo#2059139, bmo#2061220, bmo#2061242, bmo#2061285,\n bmo#2061300, bmo#2061316, bmo#2061397, bmo#2062400,\n bmo#2062419)\n Internally found bugs fixed in Firefox 155, Firefox ESR\n 153.2, Firefox ESR 140.15 and Firefox ESR 115.40","dates":{"published":"2026-09-15T14:40:48.000Z","modified":"2026-09-17T18:23:13.851Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"MozillaFirefox&distro=openSUSE Leap 16.0","name":"MozillaFirefox","label":"MozillaFirefox&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 153.2.0-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 153.2.0-160000.1.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.suse.com/1278001","label":"bugzilla.suse.com/1278001","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74952","label":"www.suse.com/security/cve/CVE-2026-74952","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75874","label":"www.suse.com/security/cve/CVE-2026-75874","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84118","label":"www.suse.com/security/cve/CVE-2026-84118","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84119","label":"www.suse.com/security/cve/CVE-2026-84119","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84120","label":"www.suse.com/security/cve/CVE-2026-84120","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84121","label":"www.suse.com/security/cve/CVE-2026-84121","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84122","label":"www.suse.com/security/cve/CVE-2026-84122","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84123","label":"www.suse.com/security/cve/CVE-2026-84123","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84124","label":"www.suse.com/security/cve/CVE-2026-84124","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84125","label":"www.suse.com/security/cve/CVE-2026-84125","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84129","label":"www.suse.com/security/cve/CVE-2026-84129","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84130","label":"www.suse.com/security/cve/CVE-2026-84130","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84131","label":"www.suse.com/security/cve/CVE-2026-84131","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84132","label":"www.suse.com/security/cve/CVE-2026-84132","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84133","label":"www.suse.com/security/cve/CVE-2026-84133","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84134","label":"www.suse.com/security/cve/CVE-2026-84134","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84136","label":"www.suse.com/security/cve/CVE-2026-84136","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84137","label":"www.suse.com/security/cve/CVE-2026-84137","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84139","label":"www.suse.com/security/cve/CVE-2026-84139","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84140","label":"www.suse.com/security/cve/CVE-2026-84140","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84141","label":"www.suse.com/security/cve/CVE-2026-84141","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84143","label":"www.suse.com/security/cve/CVE-2026-84143","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84144","label":"www.suse.com/security/cve/CVE-2026-84144","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84145","label":"www.suse.com/security/cve/CVE-2026-84145","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-74952","CVE-2026-75874","CVE-2026-84118","CVE-2026-84119","CVE-2026-84120","CVE-2026-84121","CVE-2026-84122","CVE-2026-84123","CVE-2026-84124","CVE-2026-84125","CVE-2026-84129","CVE-2026-84130","CVE-2026-84131","CVE-2026-84132","CVE-2026-84133","CVE-2026-84134","CVE-2026-84136","CVE-2026-84137","CVE-2026-84139","CVE-2026-84140","CVE-2026-84141","CVE-2026-84143","CVE-2026-84144","CVE-2026-84145"],"downstream":[],"duplicates":[],"related":["CVE-2026-74952","CVE-2026-75874","CVE-2026-84118","CVE-2026-84119","CVE-2026-84120","CVE-2026-84121","CVE-2026-84122","CVE-2026-84123","CVE-2026-84124","CVE-2026-84125","CVE-2026-84129","CVE-2026-84130","CVE-2026-84131","CVE-2026-84132","CVE-2026-84133","CVE-2026-84134","CVE-2026-84136","CVE-2026-84137","CVE-2026-84139","CVE-2026-84140","CVE-2026-84141","CVE-2026-84143","CVE-2026-84144","CVE-2026-84145"]},"timeline":[{"kind":"published","date":"2026-09-15T14:40:48.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-17T18:23:13.851Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T05:05:52.995Z","stale":false,"partial":false}}