All errata/sisyphus/ALT-PU-2026-20277-2
ALT-PU-2026-20277-2

Package update firefox in branch sisyphus

Version159.0-alt1
Task#438754
Published2026-10-27
Max severityHIGH
Severity:

Closed issues (167)

CVE-2026-100801
HIGH8.8

Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140.17.

Published: 2026-09-29Modified: 2026-10-27
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
CVE-2026-117860
NONE

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117861
NONE

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117862
NONE

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117863
NONE

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117864
NONE

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117865
NONE

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117866
NONE

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117867
NONE

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117868
NONE

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117869
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117870
NONE

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117871
NONE

Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117872
NONE

Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117873
NONE

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117874
NONE

Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117875
NONE

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117876
NONE

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117877
NONE

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117878
NONE

Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117879
NONE

Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117880
NONE

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117881
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117882
NONE

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117883
NONE

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117884
NONE

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117885
NONE

Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117886
NONE

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117887
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117888
NONE

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117889
NONE

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117890
NONE

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117891
NONE

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117892
NONE

Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117893
NONE

Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117894
NONE

Incorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117895
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117896
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117897
NONE

Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117898
NONE

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117899
NONE

Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117900
NONE

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117901
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117902
NONE

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117903
NONE

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117904
NONE

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117905
NONE

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117906
NONE

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117907
NONE

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117908
NONE

Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117909
NONE

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117910
NONE

Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117911
NONE

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117912
NONE

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117913
NONE

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117914
NONE

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117915
NONE

Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117916
NONE

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117917
NONE

Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117918
NONE

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117919
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117920
NONE

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117921
NONE

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117922
NONE

Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117923
NONE

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117924
NONE

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117925
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117926
NONE

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117927
NONE

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117928
NONE

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117929
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117930
NONE

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117931
NONE

Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117932
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117933
NONE

Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117934
NONE

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117935
NONE

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117936
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117937
NONE

Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117938
NONE

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117939
NONE

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117940
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117941
NONE

Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117942
NONE

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117943
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117944
NONE

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117945
NONE

Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117946
NONE

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117947
NONE

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117948
NONE

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117949
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117950
NONE

Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117951
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117952
NONE

Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117953
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117954
NONE

Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117955
NONE

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117956
NONE

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117957
NONE

Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117958
NONE

Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117959
NONE

Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117960
NONE

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117961
NONE

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117962
NONE

Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117963
NONE

Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117964
NONE

Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117965
NONE

Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117966
NONE

Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117967
NONE

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117968
NONE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117969
NONE

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117970
NONE

Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117971
NONE

Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117972
NONE

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117973
NONE

Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117974
NONE

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117975
NONE

Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117976
NONE

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117977
NONE

Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117978
NONE

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117979
NONE

Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117980
NONE

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117981
NONE

Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117982
NONE

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117983
NONE

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117984
NONE

Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117985
NONE

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117986
NONE

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117987
NONE

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117988
NONE

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117989
NONE

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117990
NONE

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117991
NONE

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117992
NONE

Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117993
NONE

Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117994
NONE

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117995
NONE

Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117996
NONE

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117997
NONE

Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117998
NONE

Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-117999
NONE

Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-118000
NONE

Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-118002
NONE

Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-118003
NONE

Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References
CVE-2026-118004
NONE

Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Published: 2026-10-27Modified: 2026-10-27
References