Red Hat Security Advisory

RHSA-2026:7841

firefox security update

Released 2026-04-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox-140.9.0-1.el9_2, firefox-x11-140.9.0-1.el9_2

Fixes 37 records

TI-2026-04095 CVE-2026-4700 · GHSA-4pf4-jp4v-4g5c

Authentication bypass in Mozilla Firefox

MEDIUM 51

Mitigation bypass in the Networking: HTTP component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00918 Published 2026-03-24 Partial fix · 140.9, 149 CWE-288

TI-2026-04091 CVE-2026-4696 · GHSA-h22r-8qx2-2mv3

Use after free in Mozilla Firefox

MEDIUM 51

Use-after-free in the Layout: Text and Fonts component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00967 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-416

TI-2026-04100 CVE-2026-4705 · GHSA-mrxg-j2xh-wg8q

Undefined behavior in the WebRTC: Signaling component

MEDIUM 50

Undefined behavior in the WebRTC: Signaling component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00656 Published 2026-03-24 Partial fix · 140.9, 149 CWE-758

TI-2026-04097 CVE-2026-4702 · GHSA-mrrg-439g-x65p

Type confusion in Mozilla Firefox

MEDIUM 50

JIT miscompilation in the JavaScript Engine component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.007 Published 2026-03-24 Partial fix · 140.9, 149 CWE-843

TI-2026-04112 CVE-2026-4717 · GHSA-pqfx-cwf8-965q

Privilege escalation in the Netmonitor component

MEDIUM 49

Privilege escalation in the Netmonitor component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00434 Published 2026-03-24 Partial fix · 140.9, 149

TI-2026-04106 CVE-2026-4711 · GHSA-9979-85jw-xp9m

Use after free in Mozilla Firefox

MEDIUM 49

Use-after-free in the Widget: Cocoa component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00413 Published 2026-03-24 Partial fix · 140.9, 149 CWE-416

TI-2026-04096 CVE-2026-4701 · GHSA-hxpv-3x38-h8v5

Use after free in Mozilla Firefox

MEDIUM 49

Use-after-free in the JavaScript Engine component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00478 Published 2026-03-24 Partial fix · 140.9, 149 CWE-416

TI-2026-04086 CVE-2026-4691 · GHSA-h895-88fj-h89r

Use after free in Mozilla Firefox

MEDIUM 49

Use-after-free in the CSS Parsing and Computation component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00502 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-416

TI-2026-04105 CVE-2026-4710 · GHSA-6q85-p5cm-28vf

Memory corruption in Mozilla Firefox

MEDIUM 48

Incorrect boundary conditions in the Audio/Video component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00425 Published 2026-03-24 Partial fix · 140.9, 149 CWE-119

TI-2026-04111 CVE-2026-4716 · GHSA-r67f-xmr7-94cc

Use of uninitialized resource in Mozilla Firefox

MEDIUM 46

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00423 Published 2026-03-24 Partial fix · 140.9, 149 CWE-908

TI-2026-04110 CVE-2026-4715 · GHSA-8cfw-c9hx-8f9v

Use of uninitialized resource in Mozilla Firefox

MEDIUM 46

Uninitialized memory in the Graphics: Canvas2D component.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00447 Published 2026-03-24 Partial fix · 140.9, 149 CWE-908

TI-2026-04093 CVE-2026-4698 · GHSA-cj36-hxhv-2qxh

Type confusion in Mozilla Firefox

MEDIUM 44

JIT miscompilation in the JavaScript Engine: JIT component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00785 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-843

TI-2026-04085 CVE-2026-4690 · GHSA-r7ww-hwqf-cqr6

Buffer overflow in Mozilla Firefox

MEDIUM 44

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00803 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-120

TI-2026-04084 CVE-2026-4689 · GHSA-j5qx-hh9g-j6wj

Buffer overflow in Mozilla Firefox

MEDIUM 44

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00691 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-120

TI-2026-04083 CVE-2026-4688 · GHSA-7364-g429-cg4v

Use after free in Mozilla Firefox

MEDIUM 44

Sandbox escape due to use-after-free in the Disability Access APIs component.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00552 Published 2026-03-24 Partial fix · 140.9, 149 CWE-416

TI-2026-04082 CVE-2026-4687 · GHSA-gw7x-g9xx-wmm2

Buffer overflow in Mozilla Firefox

MEDIUM 44

Sandbox escape due to incorrect boundary conditions in the Telemetry component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0056 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-120

TI-2026-04116 CVE-2026-4721 · GHSA-mmvq-h6g9-8h39

Buffer overflow in Mozilla Firefox

MEDIUM 43

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0044 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-120

TI-2026-04115 CVE-2026-4720 · GHSA-h6r3-p5gv-5qgc

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

MEDIUM 43

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0044 Published 2026-03-24 Partial fix · 140.9, 149 CWE-120

TI-2026-04087 CVE-2026-4692 · GHSA-cm3f-xp4p-xgj7

Sandbox escape in the Responsive Design Mode component

MEDIUM 43

Sandbox escape in the Responsive Design Mode component.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00506 Published 2026-03-24 Partial fix · 115.34, 140.9 +1

TI-2026-04102 CVE-2026-4707 · GHSA-xr3f-844g-572f

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions in the Graphics: Canvas2D component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.006 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04099 CVE-2026-4704 · GHSA-2mf6-25gq-26v8

Uncontrolled resource consumption in Mozilla Firefox

MEDIUM 40

Denial-of-service in the WebRTC: Signaling component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00651 Published 2026-03-24 Partial fix · 140.9, 149 CWE-400

TI-2026-04094 CVE-2026-4699 · GHSA-2qjw-h8g8-r86f

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions in the Layout: Text and Fonts component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00714 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04092 CVE-2026-4697 · GHSA-8768-346v-cvr2

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions in the Audio/Video: Web Codecs component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00714 Published 2026-03-24 Partial fix · 140.9, 149 CWE-754

TI-2026-04090 CVE-2026-4695 · GHSA-vxpv-c2h6-hq9v

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions in the Audio/Video: Web Codecs component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00714 Published 2026-03-24 Partial fix · 140.9, 149 CWE-754

TI-2026-04089 CVE-2026-4694 · GHSA-pm4j-pmqr-8gq4

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions, integer overflow in the Graphics component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00803 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04088 CVE-2026-4693 · GHSA-6956-6r33-f8xw

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions in the Audio/Video: Playback component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00714 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04081 CVE-2026-4686 · GHSA-x3f3-63g4-54j4

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions in the Graphics: Canvas2D component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00729 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04080 CVE-2026-4685 · GHSA-8mgc-3hv6-4893

Improper check for unusual conditions in Mozilla Firefox

MEDIUM 40

Incorrect boundary conditions in the Graphics: Canvas2D component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00714 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04114 CVE-2026-4719 · GHSA-qpjg-cffw-8m4r

Memory corruption in Mozilla Firefox

LOW 39

Incorrect boundary conditions in the Graphics: Text component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0045 Published 2026-03-24 Partial fix · 140.9, 149 CWE-119

TI-2026-04109 CVE-2026-4714 · GHSA-cr5g-9frg-q8m8

Improper check for unusual conditions in Mozilla Firefox

LOW 39

Incorrect boundary conditions in the Audio/Video component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0045 Published 2026-03-24 Partial fix · 140.9, 149 CWE-754

TI-2026-04108 CVE-2026-4713 · GHSA-954r-qq48-9vr2

Improper check for unusual conditions in Mozilla Firefox

LOW 39

Incorrect boundary conditions in the Graphics component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0045 Published 2026-03-24 Partial fix · 140.9, 149 CWE-754

TI-2026-04107 CVE-2026-4712 · GHSA-vcpc-fv28-ppg5

Information disclosure in Mozilla Firefox

LOW 39

Information disclosure in the Widget: Cocoa component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.004 Published 2026-03-24 Partial fix · 140.9, 149 CWE-200

TI-2026-04104 CVE-2026-4709 · GHSA-6hmc-rvh2-wxq3

Improper check for unusual conditions in Mozilla Firefox

LOW 39

Incorrect boundary conditions in the Audio/Video: GMP component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00481 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04103 CVE-2026-4708 · GHSA-5cgm-h8qg-5h77

Improper check for unusual conditions in Mozilla Firefox

LOW 39

Incorrect boundary conditions in the Graphics component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0045 Published 2026-03-24 Partial fix · 140.9, 149 CWE-754

TI-2026-04101 CVE-2026-4706 · GHSA-xh5h-c652-g9jr

Improper check for unusual conditions in Mozilla Firefox

LOW 39

Incorrect boundary conditions in the Graphics: Canvas2D component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0047 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-754

TI-2026-04113 CVE-2026-4718 · GHSA-9r85-xf24-6724

Undefined behavior in the WebRTC: Signaling component

LOW 38

Undefined behavior in the WebRTC: Signaling component.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00481 Published 2026-03-24 Partial fix · 140.9, 149 CWE-758

TI-2026-04079 CVE-2026-4684 · GHSA-3rrq-fwhx-9wq4

Race condition in Mozilla Firefox

LOW 35

Race condition, use-after-free in the Graphics: WebRender component.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00366 Published 2026-03-24 Partial fix · 115.34, 140.9 +1 CWE-362