RHSA-2026:95597

Sandbox escape due to use-after-free in the Networking component.

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component.

Sandbox escape due to uninitialized memory in the DOM: Web Serial component.

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.

Sandbox escape due to incorrect boundary conditions in the Networking component.

Privilege escalation in the WebExtensions component.

Privilege escalation in the DOM: Navigation component.

Information disclosure, privilege escalation in the Security: Process Sandboxing component.

Incorrect boundary conditions in the SVG component.

Privilege escalation in the Panning and Zooming component.

Integer overflow in the Graphics component.

Privilege escalation in the Application Update component.

Mitigation bypass in the File Handling component.

Mitigation bypass in the File Handling component.

Sandbox escape due to race condition in the Networking component.

JIT miscompilation in the JavaScript Engine: JIT component.

Mitigation bypass in the Enterprise Policies component.

Mitigation bypass in the Networking: HTTP component.

Incorrect boundary conditions in the DOM: Editor component.

Incorrect boundary conditions in the Layout component.

Other issue in the DOM: File component.

Mitigation bypass in the Enterprise Policies component.

Frame poisoning in the Layout component.

Mitigation bypass in the DOM: Security component.

JIT miscompilation in the JavaScript Engine: JIT component.

Incorrect boundary conditions in the JavaScript Engine component.

Site isolation issue in the Networking component.

Incorrect boundary conditions in the JavaScript Engine component.

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

JIT miscompilation in the JavaScript: WebAssembly component.

Sandbox escape due to uninitialized memory in the Graphics component.

Denial-of-service in the Printing: Output component.

Denial-of-service in the WebRTC component.

Spoofing issue in the DOM: Web Serial component.

Use-after-free in the DOM: Workers component.

Use-after-free in the Storage: Bucket File System component.

Use-after-free in the Audio/Video: Playback component.

Use-after-free in the DOM: Streams component.

Use-after-free in the JavaScript Engine: JIT component.

Use-after-free in the DOM: Animation component.

Use-after-free in the Audio/Video component.

Use-after-free in the SVG component.

Use-after-free in the DOM: Core & HTML component.

Use-after-free in the DOM: Core & HTML component.

Use-after-free in the XML component.

Use-after-free in the DOM: Bindings (WebIDL) component.

Use-after-free in the Crash Reporting component.

Use-after-free in the Graphics: Canvas2D component.

Use-after-free in the Graphics: Text component.

Use-after-free in the Storage: IndexedDB component.

Mitigation bypass in the Enterprise Policies component.

Mitigation bypass in the File Handling component.

Incorrect boundary conditions in the Graphics: Canvas2D component.

Integer overflow in the Layout: Text and Fonts component.

Incorrect boundary conditions in the JavaScript Engine: JIT component.

Information disclosure in the Networking component.

Information disclosure in the PDF Viewer component.

Information disclosure in the Storage: IndexedDB component.

Information disclosure in the Networking component.

Race condition, use-after-free in the Graphics: Text component.

Race condition, use-after-free in the Graphics: CanvasWebGL component.

Race condition in the XPCOM component.