Mozilla Foundation Security Advisory 2026-100

Security Vulnerabilities fixed in Firefox ESR 153.4

Announced

September 29, 2026

Impact

high

Products

Firefox ESR

Fixed in

Firefox ESR 153.4

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component

Reporter: Mozilla
Impact: high

References

Bug 2047721

#CVE-2026-100757: Use-after-free in the Widget component

Reporter: Mohamed Mbarek
Impact: high

References

Bug 2049352

#CVE-2026-100758: Sandbox escape in the DOM: Navigation component

Reporter: Mozilla
Impact: high

References

Bug 2049792

#CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component

Reporter: Mozilla
Impact: high

References

Bug 2054736

#CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component

Reporter: Mozilla
Impact: high

References

Bug 2058017

#CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component

Reporter: Yaqoub Aldurayhim
Impact: high

References

Bug 2059404

#CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: high

References

Bug 2061399

#CVE-2026-100766: Information disclosure in the Networking: JAR component

Reporter: Mozilla
Impact: high

References

Bug 2061526

#CVE-2026-100767: Use-after-free in the Networking: Cache component

Reporter: Mozilla
Impact: high

References

Bug 2063680

#CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component

Reporter: Tomer Fichman
Impact: high

References

Bug 2067190

#CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component

Reporter: Mozilla
Impact: high

References

Bug 2068322

#CVE-2026-100771: Undefined behavior in the DOM: Streams component

Reporter: Mozilla
Impact: high

References

Bug 2068336

#CVE-2026-100772: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068340

#CVE-2026-100773: Use-after-free in the Storage: IndexedDB component

Reporter: Mozilla
Impact: high

References

Bug 2068346

#CVE-2026-100774: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068351

#CVE-2026-100775: Sandbox escape in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068367

#CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: high

References

Bug 2068374

#CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2068375

#CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068406

#CVE-2026-100779: Use-after-free in the XSLT component

Reporter: Mozilla
Impact: high

References

Bug 2068417

#CVE-2026-100780: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068422

#CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Reporter: Mozilla
Impact: high

References

Bug 2068434

#CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068456

#CVE-2026-100783: Uninitialized memory in the Audio/Video component

Reporter: 5up3rh3i
Impact: high

References

Bug 2069804

#CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component

Reporter: 5up3rh3i
Impact: high

References

Bug 2070264

#CVE-2026-100785: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2071064

#CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2071067

#CVE-2026-100787: Sandbox escape in the XUL component

Reporter: Mozilla
Impact: high

References

Bug 2071068

#CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: high

References

Bug 2072413

#CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2072429

#CVE-2026-100790: Use-after-free in the XSLT component

Reporter: Mozilla
Impact: high

References

Bug 2072432

#CVE-2026-100791: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2072433

#CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2072467

#CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073266

#CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component

Reporter: Mozilla
Impact: moderate

References

Bug 2028871

#CVE-2026-96869: Information disclosure in the Networking component

Reporter: Carlo Di Dato
Impact: moderate

References

Bug 2041248

#CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component

Reporter: Mozilla
Impact: moderate

References

Bug 2050542

#CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component

Reporter: Mozilla
Impact: moderate

References

Bug 2055694

#CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component

Reporter: Mozilla
Impact: moderate

References

Bug 2056767

#CVE-2026-100801: Privilege escalation in the DLL Services component

Reporter: Mozilla
Impact: moderate

References

Bug 2057112

#CVE-2026-100803: Same-origin policy bypass in the WebExtensions component

Reporter: Yaqoub Aldurayhim
Impact: moderate

References

Bug 2057988

#CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component

Reporter: Mozilla
Impact: moderate

References

Bug 2060408

#CVE-2026-100807: Privilege escalation in the DOM: Service Workers component

Reporter: Khanh Nguyen
Impact: moderate

References

Bug 2062740

#CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component

Reporter: WinD39
Impact: moderate

References

Bug 2063488

#CVE-2026-100809: Same-origin policy bypass in the DevTools component

Reporter: Finn Westendorf
Impact: moderate

References

Bug 2063658

#CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component

Reporter: Yaqoub Aldurayhim
Impact: moderate

References

Bug 2067973

#CVE-2026-100812: Denial-of-service in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2068335

#CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: moderate

References

Bug 2068385

#CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component

Reporter: Mozilla
Impact: moderate

References

Bug 2068404

#CVE-2026-100816: Site isolation issue in the DOM: Networking component

Reporter: Rintaro Kawasugi
Impact: moderate

References

Bug 2068648

#CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component

Reporter: Mozilla
Impact: moderate

References

Bug 2069399

#CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component

Reporter: Mozilla
Impact: moderate

References

Bug 2071069

#CVE-2026-100820: Privilege escalation in the Address Bar component

Reporter: Tran Quac
Impact: moderate

References

Bug 2071645

#CVE-2026-100821: Site isolation issue in the Panning and Zooming component

Reporter: Nguyen Thanh Nguyen
Impact: moderate

References

Bug 2071784

#CVE-2026-100822: Spoofing issue in the Networking: HTTP component

Reporter: Tomoya Nakanishi
Impact: low

References

Bug 2051115

#CVE-2026-100824: Privilege escalation in the Places component

Reporter: Mozilla
Impact: low

References

Bug 2054767

#CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component

Reporter: x0e
Impact: low

References

Bug 2057465

#CVE-2026-100826: Denial-of-service in the Storage: StorageManager component

Reporter: Mozilla
Impact: low

References

Bug 2059222

#CVE-2026-100828: Mitigation bypass in the Bookmarks & History component

Reporter: Rintaro Kawasugi
Impact: low

References

Bug 2066019

#CVE-2026-100829: Mitigation bypass in the DOM: Security component

Reporter: Rintaro Kawasugi
Impact: low

References

Bug 2066321

#CVE-2026-100830: Mitigation bypass in the DOM: Navigation component

Reporter: Finn Westendorf
Impact: low

References

Bug 2066770

#CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component

Reporter: Mozilla
Impact: low

References

Bug 2067172