Red Hat Security Advisory

RHSA-2026:2047

firefox security update

Released 2026-02-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox-140.7.0-1.el9_0

Fixes 13 records

TI-2026-00663 CVE-2026-0884 · GHSA-jmj2-8j2p-hmq6

Use after free in Mozilla Firefox

MEDIUM 49

Use-after-free in the JavaScript Engine component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00463 Published 2026-01-13 Partial fix · 140.7, 147 CWE-416

TI-2026-00658 CVE-2026-0879 · GHSA-r38v-527h-36cj

Memory corruption in Mozilla Firefox

MEDIUM 49

Sandbox escape due to incorrect boundary conditions in the Graphics component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.005 Published 2026-01-13 Partial fix · 115.32, 140.7 +1 CWE-119

TI-2026-00659 CVE-2026-0880 · GHSA-jvj8-3g49-f23w

Integer overflow in Mozilla Firefox

MEDIUM 41

Sandbox escape due to integer overflow in the Graphics component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00543 Published 2026-01-13 Partial fix · 115.32, 140.7 +1 CWE-190

TI-2026-00661 CVE-2026-0882 · GHSA-x4m4-qvvc-5xcm

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the IPC component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00465 Published 2026-01-13 Partial fix · 115.32, 140.7 +1 CWE-416

TI-2025-13088 CVE-2025-14327 · GHSA-wqgj-c38v-hpmm

Authentication bypass by spoofing in Mozilla Firefox

LOW 39

Spoofing issue in the Downloads Panel component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2025-12-09 Partial fix · 140.7, 146 CWE-290

TI-2026-00670 CVE-2026-0891 · GHSA-w588-qjhp-fm98

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

LOW 38

Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00475 Published 2026-01-13 Partial fix · 140.7, 147 CWE-119

TI-2026-00656 CVE-2026-0877 · GHSA-rfgw-g9g4-685p

Protection mechanism failure in Mozilla Firefox

LOW 36

Mitigation bypass in the DOM: Security component.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00473 Published 2026-01-13 Partial fix · 115.32, 140.7 +1 CWE-693

TI-2026-00664 CVE-2026-0885 · GHSA-fw2q-3cf8-mv4x

Use after free in Mozilla Firefox

LOW 35

Use-after-free in the JavaScript: GC component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00404 Published 2026-01-13 Partial fix · 140.7, 147 CWE-416

TI-2026-00657 CVE-2026-0878 · GHSA-qc2q-rhvg-9278

Memory corruption in Mozilla Firefox

LOW 35

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00469 Published 2026-01-13 Partial fix · 140.7, 147 CWE-119

TI-2026-00665 CVE-2026-0886 · GHSA-7328-g372-24vf

Memory corruption in Mozilla Firefox

LOW 30

Incorrect boundary conditions in the Graphics component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00383 Published 2026-01-13 Partial fix · 115.32, 140.7 +1 CWE-119

TI-2026-00662 CVE-2026-0883 · GHSA-fqpc-v68g-xp98

Information disclosure in Mozilla Firefox

LOW 30

Information disclosure in the Networking component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00355 Published 2026-01-13 Partial fix · 140.7, 147 CWE-200

TI-2026-00669 CVE-2026-0890 · GHSA-484x-228c-ffm5

Authentication bypass by spoofing in Mozilla Firefox

LOW 24

Spoofing issue in the DOM: Copy & Paste and Drag & Drop component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.003 Published 2026-01-13 Partial fix · 140.7, 147 CWE-290

TI-2026-00666 CVE-2026-0887 · GHSA-96f5-9x27-7hhh

Clickjacking issue, information disclosure in the PDF Viewer component

LOW 20

Clickjacking issue, information disclosure in the PDF Viewer component.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00326 Published 2026-01-13 Partial fix · 140.7, 147 CWE-497