Mozilla Foundation Security Advisory 2026-108

Security Vulnerabilities fixed in Firefox ESR 153.5

Announced

October 13, 2026

Impact

high

Products

Firefox ESR

Fixed in

Firefox ESR 153.5

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-109704: Privilege escalation in the Application Update component

Reporter: Noel
Impact: high

References

Bug 2037979

#CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2040905

#CVE-2026-109706: Use-after-free in the Storage: IndexedDB component

Reporter: Mozilla
Impact: high

References

Bug 2053649

#CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2059150

#CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2059151

#CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component

Reporter: Yaqoub Aldurayhim
Impact: high

References

Bug 2067976

#CVE-2026-109710: Use-after-free in the Graphics: Text component

Reporter: Mozilla
Impact: high

References

Bug 2068338

#CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2068344

#CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068420

#CVE-2026-109713: Use-after-free in the Crash Reporting component

Reporter: locust1b
Impact: high

References

Bug 2068421

#CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073267

#CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2073269

#CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component

Reporter: Mozilla
Impact: high

References

Bug 2073647

#CVE-2026-109718: Use-after-free in the XML component

Reporter: Mozilla
Impact: high

References

Bug 2073692

#CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: high

References

Bug 2073969

#CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074160

#CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074161

#CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074164

#CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074171

#CVE-2026-109724: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2074193

#CVE-2026-109725: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2074208

#CVE-2026-109726: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2074212

#CVE-2026-109727: Use-after-free in the Audio/Video component

Reporter: Mozilla
Impact: high

References

Bug 2074213

#CVE-2026-109728: Use-after-free in the DOM: Animation component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074625

#CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component

Reporter: Tomer Fichman
Impact: high

References

Bug 2074632

#CVE-2026-109730: Integer overflow in the Graphics component

Reporter: Robert Longson
Impact: high

References

Bug 2074896

#CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2075436

#CVE-2026-109732: Use-after-free in the DOM: Streams component

Reporter: Mozilla
Impact: high

References

Bug 2075998

#CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2076269

#CVE-2026-109734: Mitigation bypass in the DOM: Security component

Reporter: Mirko Brodesser
Impact: moderate

References

Bug 1926318

#CVE-2026-109736: Frame poisoning in the Layout component

Reporter: Mozilla
Impact: moderate

References

Bug 2029784

#CVE-2026-109737: Mitigation bypass in the Enterprise Policies component

Reporter: Souma Ohsawa
Impact: moderate

References

Bug 2044525

#CVE-2026-109738: Use-after-free in the Audio/Video: Playback component

Reporter: Mozilla
Impact: moderate

References

Bug 2047722

#CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter: Mozilla
Impact: moderate

References

Bug 2057113

#CVE-2026-109741: Use-after-free in the Storage: Bucket File System component

Reporter: Mozilla
Impact: moderate

References

Bug 2058651

#CVE-2026-109742: Information disclosure in the PDF Viewer component

Reporter: Mozilla
Impact: moderate

References

Bug 2058800

#CVE-2026-109743: Privilege escalation in the Panning and Zooming component

Reporter: Mozilla
Impact: moderate

References

Bug 2059195

#CVE-2026-109744: Other issue in the DOM: File component

Reporter: Mozilla
Impact: moderate

References

Bug 2059211

#CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component

Reporter: Mozilla
Impact: moderate

References

Bug 2061784

#CVE-2026-109782: Mitigation bypass in the File Handling component

Reporter: Abdulrahman Alzahrani
Impact: moderate

References

Bug 2067465

#CVE-2026-109751: Information disclosure in the Networking component

Reporter: Mozilla
Impact: moderate

References

Bug 2068372

#CVE-2026-109752: Use-after-free in the DOM: Workers component

Reporter: Mozilla
Impact: moderate

References

Bug 2068407

#CVE-2026-109753: Incorrect boundary conditions in the Layout component

Reporter: Mozilla
Impact: moderate

References

Bug 2068441

#CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component

Reporter: Mozilla
Impact: moderate

References

Bug 2068443

#CVE-2026-109756: Privilege escalation in the DOM: Navigation component

Reporter: Mozilla
Impact: moderate

References

Bug 2069258

#CVE-2026-109757: Sandbox escape due to race condition in the Networking component

Reporter: Yaqoub Aldurayhim
Impact: moderate

References

Bug 2069910

#CVE-2026-109759: Site isolation issue in the Networking component

Reporter: Myungyong Lee
Impact: moderate

References

Bug 2070252

#CVE-2026-109760: Mitigation bypass in the Networking: HTTP component

Reporter: Myungyong Lee
Impact: moderate

References

Bug 2070633

#CVE-2026-109762: Incorrect boundary conditions in the SVG component

Reporter: Mozilla
Impact: moderate

References

Bug 2072438

#CVE-2026-109763: Mitigation bypass in the File Handling component

Reporter: Riku Bamba
Impact: moderate

References

Bug 2072501

#CVE-2026-109764: Mitigation bypass in the Enterprise Policies component

Reporter: HyeonSeung Kim
Impact: moderate

References

Bug 2073382

#CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: moderate

References

Bug 2073396

#CVE-2026-109766: Mitigation bypass in the Enterprise Policies component

Reporter: Souma Ohsawa
Impact: moderate

References

Bug 2074406

#CVE-2026-109767: Information disclosure in the Networking component

Reporter: Mozilla
Impact: moderate

References

Bug 2074963

#CVE-2026-109783: Mitigation bypass in the File Handling component

Reporter: Mozilla
Impact: moderate

References

Bug 2075533

#CVE-2026-109770: Spoofing issue in the DOM: Web Serial component

Reporter: Mozilla
Impact: low

References

Bug 2059230

#CVE-2026-109775: Denial-of-service in the WebRTC component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: low

References

Bug 2068255

#CVE-2026-109776: Race condition in the XPCOM component

Reporter: Mozilla
Impact: low

References

Bug 2069395

#CVE-2026-109777: Information disclosure in the Storage: IndexedDB component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: low

References

Bug 2069638

#CVE-2026-109778: Privilege escalation in the WebExtensions component

Reporter: Mozilla
Impact: low

References

Bug 2070547

#CVE-2026-109781: Denial-of-service in the Printing: Output component

Reporter: Nguyen Thanh Nguyen
Impact: low

References

Bug 2072852