Red Hat Security Advisory

RHSA-2026:76894

firefox security update

Released 2026-10-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-140.15.0-1.el8_4
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox-140.15.0-1.el8_4

Fixes 10 records

TI-2026-57864 CVE-2026-84143 · GHSA-hcr8-q9p9-c49f

Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15

MEDIUM 49

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00378 Published 2026-09-01 Partial fix · 140.15, 153.2 +1 CWE-200

TI-2026-53114 CVE-2026-75874 · GHSA-xxrc-g5c2-523g

Protection mechanism failure in Mozilla Firefox

MEDIUM 49

Sandbox escape in the Remote Settings Client component.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00455 Published 2026-08-18 Partial fix · 115.40, 140.15 +2 CWE-693

TI-2026-57842 CVE-2026-84121 · GHSA-5g9x-cffv-ccj8

Use after free in Mozilla Firefox

MEDIUM 43

Sandbox escape due to use-after-free in the DOM: Security component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00319 Published 2026-09-01 Partial fix · 115.40, 140.15 +2 CWE-416

TI-2026-57840 CVE-2026-84119 · GHSA-jm34-3r5q-pm6j

Use after free in Mozilla Firefox

MEDIUM 43

Sandbox escape due to use-after-free in the DOM: Navigation component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00319 Published 2026-09-01 Partial fix · 115.40, 140.15 +2 CWE-416

TI-2026-57852 CVE-2026-84131 · GHSA-8v78-cgm6-v8h8

Privilege escalation due to invalid pointer in the Graphics component

MEDIUM 40

Privilege escalation due to invalid pointer in the Graphics component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00328 Published 2026-09-01 Partial fix · 115.40, 140.15 +2 CWE-763

TI-2026-13672 CVE-2026-16365 · GHSA-534q-w7ff-7vh6

Improper privilege management in Mozilla Firefox

MEDIUM 40

Privilege escalation in the DOM: Workers component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00278 Published 2026-07-21 Partial fix · 140.15, 153 CWE-269

TI-2026-57866 CVE-2026-84145 · GHSA-6w89-9jrv-4j59

Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15

LOW 35

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.0037 Published 2026-09-01 Partial fix · 115.40, 140.15 +2 CWE-119

TI-2026-57845 CVE-2026-84124 · GHSA-668r-xjh4-3hm3

Use after free in Mozilla Firefox

LOW 24

Use-after-free in the DOM: Core & HTML component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0017 Published 2026-09-01 Partial fix · 140.15, 153.2 +1 CWE-416

TI-2026-57843 CVE-2026-84122 · GHSA-597r-7m7p-2q8x

Use after free in Mozilla Firefox

LOW 24

Use-after-free in the Audio/Video component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00214 Published 2026-09-01 Partial fix · 140.15, 153.2 +1 CWE-416

TI-2026-57841 CVE-2026-84120 · GHSA-8rw8-779w-6fpc

Use after free in Mozilla Firefox

LOW 24

Use-after-free in the Audio/Video component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00219 Published 2026-09-01 Partial fix · 115.40, 140.15 +2 CWE-416