Mozilla Foundation Security Advisory 2026-107
Security Vulnerabilities fixed in Firefox ESR 115.43
- Announced
- October 13, 2026
- Impact
- high
- Products
- Firefox ESR
- Fixed in
-
- Firefox ESR 115.43
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-109706: Use-after-free in the Storage: IndexedDB component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109710: Use-after-free in the Graphics: Text component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-109718: Use-after-free in the XML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component
- Reporter
- Shu Takahashi of Velcore Consulting Inc.
- Impact
- high
References
#CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-109725: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109726: Use-after-free in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109727: Use-after-free in the Audio/Video component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109728: Use-after-free in the DOM: Animation component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component
- Reporter
- Tomer Fichman
- Impact
- high
References
#CVE-2026-109730: Integer overflow in the Graphics component
- Reporter
- Robert Longson
- Impact
- high
References
#CVE-2026-109732: Use-after-free in the DOM: Streams component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-109753: Incorrect boundary conditions in the Layout component
- Reporter
- Mozilla
- Impact
- moderate