RLSA-2026:99112

Security

Mirrored from RHSA-2026:99112

Issued at: 2026-11-13

Updated at: 2026-11-14

Advisory content derived from Red Hat RHSA-2026:99112, © Red Hat, Inc., used under CC BY 4.0, with modifications.

Synopsis

Important: firefox security update

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-118007)

* firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component (CVE-2026-118021)

* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-118024)

* firefox: thunderbird: Race condition, use-after-free in the DOM: File component (CVE-2026-118019)

* firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124860)

* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-124914)

* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124869)

* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-124854)

* firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-124877)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-124917)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component (CVE-2026-124891)

* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-124857)

* firefox: thunderbird: Information disclosure in the Security: RLBox component (CVE-2026-124941)

* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124855)

* firefox: thunderbird: Spoofing issue in the Security component (CVE-2026-124934)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component (CVE-2026-124853)

* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124905)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component (CVE-2026-124859)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124881)

* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124862)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124882)

* firefox: thunderbird: Information disclosure in the Private Browsing component (CVE-2026-124909)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124876)

* firefox: thunderbird: Use-after-free in the DOM: Workers component (CVE-2026-124893)

* firefox: thunderbird: Use-after-free in the Graphics: WebRender component (CVE-2026-124906)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124887)

* firefox: thunderbird: Mitigation bypass in the WebExtensions component (CVE-2026-124910)

* firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component (CVE-2026-124951)

* firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124865)

* firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component (CVE-2026-124948)

* firefox: thunderbird: Undefined behavior in the WebRTC: Networking component (CVE-2026-124935)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component (CVE-2026-124875)

* firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component (CVE-2026-124903)

* firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component (CVE-2026-124856)

* firefox: thunderbird: Use-after-free in the Networking: Cookies component (CVE-2026-124894)

* firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component (CVE-2026-124895)

* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-124885)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-124899)

* firefox: thunderbird: Sandbox escape in the Console component (CVE-2026-124933)

* firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-124866)

* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124883)

* firefox: thunderbird: Information disclosure in the Layout: Form Controls component (CVE-2026-124929)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2026-124870)

* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-124927)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component (CVE-2026-124915)

* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124890)

* firefox: thunderbird: Information disclosure in the Address Bar component (CVE-2026-124930)

* firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124886)

* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124858)

* firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component (CVE-2026-124907)

* firefox: thunderbird: Invalid pointer in the DOM: Editor component (CVE-2026-124873)

* firefox: thunderbird: Spoofing issue in the DOM: Security component (CVE-2026-124912)

* firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-124874)

* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124892)

* firefox: thunderbird: Invalid pointer in the DOM: Streams component (CVE-2026-124942)

* firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component (CVE-2026-124922)

* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124918)

* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124884)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-124868)

* firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component (CVE-2026-124919)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124924)

* firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component (CVE-2026-124902)

* firefox: thunderbird: Invalid pointer in the Networking: Cache component (CVE-2026-124879)

* firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-124932)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-124940)

* firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component (CVE-2026-124931)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-124926)

* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124863)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124889)

* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-124913)

* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124897)

* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component (CVE-2026-124864)

* firefox: thunderbird: Use-after-free in the Cycle Collector component (CVE-2026-124872)

* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124880)

* firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124896)

* firefox: thunderbird: Other issue in the Networking: JAR component (CVE-2026-124901)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124888)

* firefox: thunderbird: Mitigation bypass in the Add-ons Manager component (CVE-2026-124938)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component (CVE-2026-124861)

* firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-124898)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-124939)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 8 aarch64

Rocky Linux 8 x86_64

Fixes

2562015

2562042

2562122

2562259

2569830

2569846

2569877

2569907

2569955

2569957

2569970

2569978

2569982

2569985

2569994

2570012

2570014

2570100

2570107

2570116

2570127

2570137

2570140

2570149

2570165

2570172

2570208

2570241

2570248

2570255

2570306

2570334

2570365

2570417

2570433

2570440

2570491

2570514

2570521

2570548

2570574

2570589

2570601

2570629

2570636

2570644

2570655

2570660

2570662

2570664

2570686

2570704

2570705

2570717

2570726

2570740

2570753

2570755

2570770

2570787

2570811

2570824

2570865

2570876

2570896

2570942

2570955

2571008

2571031

2571052

2571076

2571102

2571104

2571112

2571117

2571125

2571126

2571146

2571152

2571158

2571162

CVEs

CVE-2026-118007

CVE-2026-118019

CVE-2026-118021

CVE-2026-118024

CVE-2026-124853

CVE-2026-124854

CVE-2026-124855

CVE-2026-124856

CVE-2026-124857

CVE-2026-124858

CVE-2026-124859

CVE-2026-124860

CVE-2026-124861

CVE-2026-124862

CVE-2026-124863

CVE-2026-124864

CVE-2026-124865

CVE-2026-124866

CVE-2026-124868

CVE-2026-124869

CVE-2026-124870

CVE-2026-124872

CVE-2026-124873

CVE-2026-124874

CVE-2026-124875

CVE-2026-124876

CVE-2026-124877

CVE-2026-124879

CVE-2026-124880

CVE-2026-124881

CVE-2026-124882

CVE-2026-124883

CVE-2026-124884

CVE-2026-124885

CVE-2026-124886

CVE-2026-124887

CVE-2026-124888

CVE-2026-124889

CVE-2026-124890

CVE-2026-124891

CVE-2026-124892

CVE-2026-124893

CVE-2026-124894

CVE-2026-124895

CVE-2026-124896

CVE-2026-124897

CVE-2026-124898

CVE-2026-124899

CVE-2026-124901

CVE-2026-124902

CVE-2026-124903

CVE-2026-124905

CVE-2026-124906

CVE-2026-124907

CVE-2026-124909

CVE-2026-124910

CVE-2026-124912

CVE-2026-124913

CVE-2026-124914

CVE-2026-124915

CVE-2026-124917

CVE-2026-124918

CVE-2026-124919

CVE-2026-124922

CVE-2026-124924

CVE-2026-124926

CVE-2026-124927

CVE-2026-124929

CVE-2026-124930

CVE-2026-124931

CVE-2026-124932

CVE-2026-124933

CVE-2026-124934

CVE-2026-124935

CVE-2026-124938

CVE-2026-124939

CVE-2026-124940

CVE-2026-124941

CVE-2026-124942

CVE-2026-124948

CVE-2026-124951

Affected packages

Rocky Linux 8 aarch64 - AppStream

firefox-0:153.7.0-1.el8_10.aarch64.rpm

firefox-debuginfo-0:153.7.0-1.el8_10.aarch64.rpm

firefox-debugsource-0:153.7.0-1.el8_10.aarch64.rpm

Rocky Linux 8 x86_64 - AppStream

firefox-0:153.7.0-1.el8_10.src.rpm

firefox-0:153.7.0-1.el8_10.x86_64.rpm

firefox-debuginfo-0:153.7.0-1.el8_10.x86_64.rpm

firefox-debugsource-0:153.7.0-1.el8_10.x86_64.rpm