Opened 3 weeks ago
Closed 2 weeks ago
#24024 closed enhancement (fixed)
firefox-153.4.0esr
| Reported by: | Joe Locash | Owned by: | SecurityAdvisory |
|---|---|---|---|
| Priority: | elevated | Milestone: | 98-Security |
| Component: | BOOK | Version: | git |
| Severity: | high | Keywords: | |
| Cc: |
Description
New minor version. Release notes are not available yet.
Change History (3)
comment:1 by , 3 weeks ago
comment:2 by , 3 weeks ago
| Milestone: | 13.2 → 98-Security |
|---|---|
| Owner: | changed from to |
| Priority: | normal → elevated |
| Severity: | normal → high |
| Status: | assigned → new |
Security fixes:
- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component (high)
- CVE-2026-100757: Use-after-free in the Widget component (high)
- CVE-2026-100758: Sandbox escape in the DOM: Navigation component (high)
- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component (high)
- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component (high)
- CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component (high)
- CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component (high)
- CVE-2026-100766: Information disclosure in the Networking: JAR component (high)
- CVE-2026-100767: Use-after-free in the Networking: Cache component (high)
- CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component (high)
- CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component (high)
- CVE-2026-100771: Undefined behavior in the DOM: Streams component (high)
- CVE-2026-100772: Use-after-free in the DOM: Core & HTML component (high)
- CVE-2026-100773: Use-after-free in the Storage: IndexedDB component (high)
- CVE-2026-100774: Use-after-free in the DOM: Core & HTML component (high)
- CVE-2026-100775: Sandbox escape in the Graphics component (high)
- CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component (high)
- CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component (high)
- CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component (high)
- CVE-2026-100779: Use-after-free in the XSLT component (high)
- CVE-2026-100780: Use-after-free in the DOM: Core & HTML component (high)
- CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (high)
- CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component (high)
- CVE-2026-100783: Uninitialized memory in the Audio/Video component (high)
- CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component (high)
- CVE-2026-100785: Use-after-free in the DOM: Core & HTML component (high)
- CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component (high)
- CVE-2026-100787: Sandbox escape in the XUL component (high)
- CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component (high)
- CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component (high)
- CVE-2026-100790: Use-after-free in the XSLT component (high)
- CVE-2026-100791: Use-after-free in the DOM: Core & HTML component (high)
- CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component (high)
- CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component (high)
- CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component (moderate)
- CVE-2026-96869: Information disclosure in the Networking component (moderate)
- CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component (moderate)
- CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component (moderate)
- CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component (moderate)
- CVE-2026-100801: Privilege escalation in the DLL Services component (moderate)
- CVE-2026-100803: Same-origin policy bypass in the WebExtensions component (moderate)
- CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component (moderate)
- CVE-2026-100807: Privilege escalation in the DOM: Service Workers component (moderate)
- CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component (moderate)
- CVE-2026-100809: Same-origin policy bypass in the DevTools component (moderate)
- CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component (moderate)
- CVE-2026-100812: Denial-of-service in the Graphics component (moderate)
- CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component (moderate)
- CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component (moderate)
- CVE-2026-100816: Site isolation issue in the DOM: Networking component (moderate)
- CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component (moderate)
- CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component (moderate)
- CVE-2026-100820: Privilege escalation in the Address Bar component (moderate)
- CVE-2026-100821: Site isolation issue in the Panning and Zooming component (moderate)
- CVE-2026-100822: Spoofing issue in the Networking: HTTP component (low)
- CVE-2026-100824: Privilege escalation in the Places component (low)
- CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component (low)
- CVE-2026-100826: Denial-of-service in the Storage: StorageManager component (low)
- CVE-2026-100828: Mitigation bypass in the Bookmarks & History component (low)
- CVE-2026-100829: Mitigation bypass in the DOM: Security component (low)
- CVE-2026-100830: Mitigation bypass in the DOM: Navigation component (low)
- CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component (low)
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/
comment:3 by , 2 weeks ago
| Resolution: | → fixed |
|---|---|
| Status: | new → closed |
Advisory sa-13.1-049 has been issued.
Note:
See TracTickets
for help on using tickets.
Fixed at 017a382d84. Leaving open pending release notes.