{"schema_version": "1.7.0", "id": "RLSA-2026:99112", "modified": "2026-11-13T06:04:57.954914Z", "published": "2026-11-13T06:01:39.166938Z", "upstream": ["CVE-2026-118007", "CVE-2026-118019", "CVE-2026-118021", "CVE-2026-118024", "CVE-2026-124853", "CVE-2026-124854", "CVE-2026-124855", "CVE-2026-124856", "CVE-2026-124857", "CVE-2026-124858", "CVE-2026-124859", "CVE-2026-124860", "CVE-2026-124861", "CVE-2026-124862", "CVE-2026-124863", "CVE-2026-124864", "CVE-2026-124865", "CVE-2026-124866", "CVE-2026-124868", "CVE-2026-124869", "CVE-2026-124870", "CVE-2026-124872", "CVE-2026-124873", "CVE-2026-124874", "CVE-2026-124875", "CVE-2026-124876", "CVE-2026-124877", "CVE-2026-124879", "CVE-2026-124880", "CVE-2026-124881", "CVE-2026-124882", "CVE-2026-124883", "CVE-2026-124884", "CVE-2026-124885", "CVE-2026-124886", "CVE-2026-124887", "CVE-2026-124888", "CVE-2026-124889", "CVE-2026-124890", "CVE-2026-124891", "CVE-2026-124892", "CVE-2026-124893", "CVE-2026-124894", "CVE-2026-124895", "CVE-2026-124896", "CVE-2026-124897", "CVE-2026-124898", "CVE-2026-124899", "CVE-2026-124901", "CVE-2026-124902", "CVE-2026-124903", "CVE-2026-124905", "CVE-2026-124906", "CVE-2026-124907", "CVE-2026-124909", "CVE-2026-124910", "CVE-2026-124912", "CVE-2026-124913", "CVE-2026-124914", "CVE-2026-124915", "CVE-2026-124917", "CVE-2026-124918", "CVE-2026-124919", "CVE-2026-124922", "CVE-2026-124924", "CVE-2026-124926", "CVE-2026-124927", "CVE-2026-124929", "CVE-2026-124930", "CVE-2026-124931", "CVE-2026-124932", "CVE-2026-124933", "CVE-2026-124934", "CVE-2026-124935", "CVE-2026-124938", "CVE-2026-124939", "CVE-2026-124940", "CVE-2026-124941", "CVE-2026-124942", "CVE-2026-124948", "CVE-2026-124951"], "summary": "Important: firefox security update", "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-118007)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component (CVE-2026-118021)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-118024)\n\n* firefox: thunderbird: Race condition, use-after-free in the DOM: File component (CVE-2026-118019)\n\n* firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124860)\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-124914)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124869)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-124854)\n\n* firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-124877)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-124917)\n\n* firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component (CVE-2026-124891)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-124857)\n\n* firefox: thunderbird: Information disclosure in the Security: RLBox component (CVE-2026-124941)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124855)\n\n* firefox: thunderbird: Spoofing issue in the Security component (CVE-2026-124934)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component (CVE-2026-124853)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124905)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component (CVE-2026-124859)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124881)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124862)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124882)\n\n* firefox: thunderbird: Information disclosure in the Private Browsing component (CVE-2026-124909)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124876)\n\n* firefox: thunderbird: Use-after-free in the DOM: Workers component (CVE-2026-124893)\n\n* firefox: thunderbird: Use-after-free in the Graphics: WebRender component (CVE-2026-124906)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124887)\n\n* firefox: thunderbird: Mitigation bypass in the WebExtensions component (CVE-2026-124910)\n\n* firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component (CVE-2026-124951)\n\n* firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124865)\n\n* firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component (CVE-2026-124948)\n\n* firefox: thunderbird: Undefined behavior in the WebRTC: Networking component (CVE-2026-124935)\n\n* firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component (CVE-2026-124875)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component (CVE-2026-124903)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component (CVE-2026-124856)\n\n* firefox: thunderbird: Use-after-free in the Networking: Cookies component (CVE-2026-124894)\n\n* firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component (CVE-2026-124895)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-124885)\n\n* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-124899)\n\n* firefox: thunderbird: Sandbox escape in the Console component (CVE-2026-124933)\n\n* firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-124866)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124883)\n\n* firefox: thunderbird: Information disclosure in the Layout: Form Controls component (CVE-2026-124929)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2026-124870)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-124927)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component (CVE-2026-124915)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124890)\n\n* firefox: thunderbird: Information disclosure in the Address Bar component (CVE-2026-124930)\n\n* firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124886)\n\n* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124858)\n\n* firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component (CVE-2026-124907)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Editor component (CVE-2026-124873)\n\n* firefox: thunderbird: Spoofing issue in the DOM: Security component (CVE-2026-124912)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-124874)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124892)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Streams component (CVE-2026-124942)\n\n* firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component (CVE-2026-124922)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124918)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124884)\n\n* firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-124868)\n\n* firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component (CVE-2026-124919)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124924)\n\n* firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component (CVE-2026-124902)\n\n* firefox: thunderbird: Invalid pointer in the Networking: Cache component (CVE-2026-124879)\n\n* firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-124932)\n\n* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-124940)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component (CVE-2026-124931)\n\n* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-124926)\n\n* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124863)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124889)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-124913)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124897)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component (CVE-2026-124864)\n\n* firefox: thunderbird: Use-after-free in the Cycle Collector component (CVE-2026-124872)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124880)\n\n* firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124896)\n\n* firefox: thunderbird: Other issue in the Networking: JAR component (CVE-2026-124901)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124888)\n\n* firefox: thunderbird: Mitigation bypass in the Add-ons Manager component (CVE-2026-124938)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component (CVE-2026-124861)\n\n* firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-124898)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-124939)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}], "affected": [{"package": {"ecosystem": "Rocky Linux:8", "name": "firefox", "purl": "pkg:rpm/rocky-linux/firefox?distro=rocky-linux-8&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:153.7.0-1.el8_10"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "firefox-debuginfo", "purl": "pkg:rpm/rocky-linux/firefox-debuginfo?distro=rocky-linux-8&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:153.7.0-1.el8_10"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "firefox-debugsource", "purl": "pkg:rpm/rocky-linux/firefox-debugsource?distro=rocky-linux-8&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:153.7.0-1.el8_10"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "firefox", "purl": "pkg:rpm/rocky-linux/firefox?distro=rocky-linux-8&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:153.7.0-1.el8_10"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "firefox-debuginfo", "purl": "pkg:rpm/rocky-linux/firefox-debuginfo?distro=rocky-linux-8&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:153.7.0-1.el8_10"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "firefox-debugsource", "purl": "pkg:rpm/rocky-linux/firefox-debugsource?distro=rocky-linux-8&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:153.7.0-1.el8_10"}], "database_specific": {"yum_repository": "AppStream"}}]}], "references": [{"type": "ADVISORY", "url": "https://errata.rockylinux.org/RLSA-2026:99112"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562015"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562042"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562122"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562259"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569830"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569846"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569877"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569907"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569955"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569957"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569970"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569978"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569982"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569985"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569994"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570012"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570014"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570100"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570107"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570116"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570127"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570137"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570140"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570149"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570165"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570172"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570208"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570241"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570248"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570255"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570306"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570334"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570365"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570417"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570433"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570440"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570491"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570514"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570521"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570548"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570574"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570589"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570601"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570629"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570636"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570644"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570655"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570660"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570662"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570664"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570686"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570704"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570705"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570717"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570726"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570740"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570753"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570755"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570770"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570787"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570811"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570824"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570865"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570876"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570896"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570942"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570955"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571008"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571031"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571052"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571076"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571102"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571104"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571112"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571117"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571125"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571126"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571146"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571152"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571158"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571162"}, {"type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:99112"}], "credits": [{"name": "Rocky Enterprise Software Foundation"}, {"name": "Red Hat"}], "database_specific": {"license": "CC-BY-4.0", "license_url": "https://creativecommons.org/licenses/by/4.0/", "source_advisory": "RHSA-2026:99112"}}