Mozilla Foundation Security Advisory 2026-120

Security Vulnerabilities fixed in Firefox ESR 153.6

Announced

October 27, 2026

Impact

high

Products

Firefox ESR

Fixed in

Firefox ESR 153.6

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component

Reporter: satyamasd
Impact: high

References

Bug 2046558

#CVE-2026-117861: Sandbox escape in the DOM: Navigation component

Reporter: Mozilla
Impact: high

References

Bug 2053240

#CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2054644

#CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component

Reporter: Mozilla
Impact: high

References

Bug 2056783

#CVE-2026-117864: Sandbox escape in the Form Manager component

Reporter: Mozilla
Impact: high

References

Bug 2058614

#CVE-2026-117865: Use-after-free in the JavaScript: GC component

Reporter: Mozilla
Impact: high

References

Bug 2058653

#CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2059011

#CVE-2026-117867: Use-after-free in the Layout component

Reporter: Mozilla
Impact: high

References

Bug 2059110

#CVE-2026-117868: Sandbox escape in the DOM: Networking component

Reporter: Yaqoub Aldurayhim
Impact: high

References

Bug 2059961

#CVE-2026-117869: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2068362

#CVE-2026-117870: Use-after-free in the JavaScript Engine component

Reporter: Mozilla
Impact: high

References

Bug 2068395

#CVE-2026-117871: Invalid pointer in the Graphics component

Reporter: Mozilla
Impact: high

References

Bug 2068400

#CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component

Reporter: Mozilla
Impact: high

References

Bug 2068410

#CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component

Reporter: Mozilla
Impact: high

References

Bug 2071733

#CVE-2026-117874: Use-after-free in the Internationalization component

Reporter: Mozilla
Impact: high

References

Bug 2073685

#CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component

Reporter: Mozilla
Impact: high

References

Bug 2073686

#CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2074167

#CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component

Reporter: Mozilla
Impact: high

References

Bug 2074209

#CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2075431

#CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2075432

#CVE-2026-117880: Use-after-free in the XML component

Reporter: Mozilla
Impact: high

References

Bug 2075996

#CVE-2026-117881: Use-after-free in the DOM: Core & HTML component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2076267

#CVE-2026-117882: Use-after-free in the Layout component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2076268

#CVE-2026-117883: Use-after-free in the DOM: HTML Parser component

Reporter: Amy Burnett of OpenAI
Impact: high

References

Bug 2076271

#CVE-2026-117884: Use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2076410

#CVE-2026-117885: Use-after-free in the Layout: Grid component

Reporter: Mozilla
Impact: high

References

Bug 2076983

#CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component

Reporter: tsui
Impact: high

References

Bug 2077162

#CVE-2026-117887: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2077385

#CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component

Reporter: Minseong Kim
Impact: high

References

Bug 2078649

#CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component

Reporter: Mozilla
Impact: high

References

Bug 2078727

#CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: high

References

Bug 2078749

#CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: high

References

Bug 2078837

#CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component

Reporter: Mozilla
Impact: high

References

Bug 2078902

#CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component

Reporter: Mozilla
Impact: high

References

Bug 2078946

#CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component

Reporter: Mozilla
Impact: high

References

Bug 2078983

#CVE-2026-117895: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2078994

#CVE-2026-117896: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2079032

#CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component

Reporter: Mozilla
Impact: high

References

Bug 2079036

#CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: high

References

Bug 2079040

#CVE-2026-117899: Use-after-free in the Networking: HTTP component

Reporter: Mozilla
Impact: high

References

Bug 2079046

#CVE-2026-117900: Use-after-free in the DOM: Editor component

Reporter: Mozilla
Impact: high

References

Bug 2079053

#CVE-2026-117901: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2079054

#CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component

Reporter: Mozilla
Impact: high

References

Bug 2079057

#CVE-2026-117903: Use-after-free in the Audio/Video component

Reporter: Mozilla
Impact: high

References

Bug 2079058

#CVE-2026-117904: Use-after-free in the JavaScript: GC component

Reporter: Mozilla
Impact: high

References

Bug 2079059

#CVE-2026-117905: Use-after-free in the Audio/Video: Playback component

Reporter: Mozilla
Impact: high

References

Bug 2079061

#CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component

Reporter: Mozilla
Impact: high

References

Bug 2079062

#CVE-2026-117907: Use-after-free in the Networking component

Reporter: Mozilla
Impact: high

References

Bug 2079068

#CVE-2026-117908: Use-after-free in the Graphics: ImageLib component

Reporter: Mozilla
Impact: high

References

Bug 2079069

#CVE-2026-117909: Use-after-free in the JavaScript: GC component

Reporter: Mozilla
Impact: high

References

Bug 2079155

#CVE-2026-117910: Invalid pointer in the JavaScript Engine component

Reporter: Mozilla
Impact: high

References

Bug 2079156

#CVE-2026-117911: Use-after-free in the Audio/Video: Playback component

Reporter: Mozilla
Impact: high

References

Bug 2079171

#CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component

Reporter: Takashi Suzuki
Impact: high

References

Bug 2079209

#CVE-2026-117913: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2079252

#CVE-2026-117914: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2079253

#CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component

Reporter: Mozilla
Impact: high

References

Bug 2079255

#CVE-2026-117916: Use-after-free in the XSLT component

Reporter: Mozilla
Impact: high

References

Bug 2079257

#CVE-2026-117917: Invalid pointer in the Graphics: WebRender component

Reporter: Nguyen Tuan Hung
Impact: high

References

Bug 2079301

#CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component

Reporter: Mozilla
Impact: high

References

Bug 2079676

#CVE-2026-117919: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2079677

#CVE-2026-117920: Use-after-free in the DOM: HTML Parser component

Reporter: Mozilla
Impact: high

References

Bug 2079681

#CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2079687

#CVE-2026-117922: Use-after-free in the Networking: WebSockets component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2079692

#CVE-2026-117923: Use-after-free in the Audio/Video component

Reporter: Mozilla
Impact: high

References

Bug 2079781

#CVE-2026-117924: Use-after-free in the XSLT component

Reporter: Mozilla
Impact: high

References

Bug 2079783

#CVE-2026-117925: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2079786

#CVE-2026-117926: Incorrect boundary conditions in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2079924

#CVE-2026-117927: Use-after-free in the SVG component

Reporter: Mozilla
Impact: high

References

Bug 2080102

#CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component

Reporter: Minseong Kim
Impact: high

References

Bug 2081280

#CVE-2026-117929: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: high

References

Bug 2081549

#CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2081953

#CVE-2026-117931: Use-after-free in the DOM: Events component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2081969

#CVE-2026-117932: Use-after-free in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2081975

#CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2081976

#CVE-2026-117934: Use-after-free in the Layout component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2081977

#CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082000

#CVE-2026-117936: Use-after-free in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082001

#CVE-2026-117937: Invalid pointer in the JavaScript Engine component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082005

#CVE-2026-117938: Use-after-free in the Layout component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082009

#CVE-2026-117939: Use-after-free in the XML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082030

#CVE-2026-117940: Use-after-free in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082031

#CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082044

#CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082047

#CVE-2026-117943: Use-after-free in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082061

#CVE-2026-117944: Use-after-free in the Layout component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082064

#CVE-2026-117945: Incorrect boundary conditions in the XML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082076

#CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082092

#CVE-2026-117947: Use-after-free in the XML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082100

#CVE-2026-117948: Use-after-free in the SVG component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082112

#CVE-2026-117949: Use-after-free in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082118

#CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082127

#CVE-2026-117951: Use-after-free in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082130

#CVE-2026-117952: Uninitialized memory in the Networking component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082139

#CVE-2026-117953: Use-after-free in the DOM: Core & HTML component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082199

#CVE-2026-117954: Use-after-free in the Layout: Positioned component

Reporter: OpenAI Codex Security (kylebot)
Impact: high

References

Bug 2082450

#CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component

Reporter: Mozilla
Impact: moderate

References

Bug 2043044

#CVE-2026-100801: Privilege escalation in the DLL Services component

Reporter: Mozilla
Impact: moderate

References

Bug 2057112

#CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component

Reporter: Mozilla
Impact: moderate

References

Bug 2058659

#CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component

Reporter: Mozilla
Impact: moderate

References

Bug 2061508

#CVE-2026-117958: Site isolation issue in the Networking: HTTP component

Reporter: Mozilla
Impact: moderate

References

Bug 2061509

#CVE-2026-117959: Site isolation issue in the DOM: Service Workers component

Reporter: Muhammad Ali
Impact: moderate

References

Bug 2067292

#CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component

Reporter: Mohamed Mbarek
Impact: moderate

References

Bug 2067647

#CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component

Reporter: Mozilla
Impact: moderate

References

Bug 2068458

#CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component

Reporter: Mozilla
Impact: moderate

References

Bug 2072411

#CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component

Reporter: Mozilla
Impact: moderate

References

Bug 2073660

#CVE-2026-117964: Use-after-free in the Panning and Zooming component

Reporter: Mozilla
Impact: moderate

References

Bug 2074199

#CVE-2026-117965: Same-origin policy bypass in the Address Bar component

Reporter: Takashi Suzuki
Impact: moderate

References

Bug 2075126

#CVE-2026-117966: Site isolation issue in the Networking: HTTP component

Reporter: Mozilla
Impact: moderate

References

Bug 2075726

#CVE-2026-117967: Mitigation bypass in the DOM: Security component

Reporter: Nguyen Tuan Hung
Impact: moderate

References

Bug 2075930

#CVE-2026-117968: Use-after-free in the DOM: Core & HTML component

Reporter: Mozilla
Impact: moderate

References

Bug 2075985

#CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: moderate

References

Bug 2075990

#CVE-2026-117970: Race condition in the Disability Access APIs component

Reporter: Nguyen Thanh Nguyen
Impact: moderate

References

Bug 2076227

#CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview component

Reporter: Mozilla
Impact: moderate

References

Bug 2076399

#CVE-2026-117972: Use-after-free in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2076415

#CVE-2026-117973: Use-after-free in the Networking: DNS component

Reporter: Mozilla
Impact: moderate

References

Bug 2076704

#CVE-2026-117974: Use-after-free in the XML component

Reporter: Mozilla
Impact: moderate

References

Bug 2076705

#CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics: WebRender component

Reporter: Mozilla
Impact: moderate

References

Bug 2076714

#CVE-2026-117976: Site isolation issue in the DOM: Navigation component

Reporter: Shu Takahashi of Velcore Consulting Inc.
Impact: moderate

References

Bug 2076816

#CVE-2026-117977: Other issue in the Console component

Reporter: quanhx
Impact: moderate

References

Bug 2077418

#CVE-2026-117978: Incorrect boundary conditions in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2077730

#CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender component

Reporter: Mozilla
Impact: moderate

References

Bug 2077739

#CVE-2026-117980: Use-after-free in the Graphics component

Reporter: Massimo Palozzi
Impact: moderate

References

Bug 2078145

#CVE-2026-117981: Privilege escalation in the Toolkit component

Reporter: Mozilla
Impact: moderate

References

Bug 2078167

#CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component

Reporter: Mozilla
Impact: moderate

References

Bug 2078855

#CVE-2026-117983: Use-after-free in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2078904

#CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and Overflow component

Reporter: Mozilla
Impact: moderate

References

Bug 2078981

#CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2078982

#CVE-2026-117986: Use-after-free in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2078989

#CVE-2026-117987: Use-after-free in the Graphics component

Reporter: Mozilla
Impact: moderate

References

Bug 2079065

#CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter: Mozilla
Impact: moderate

References

Bug 2079072

#CVE-2026-117989: Use-after-free in the Graphics component

Reporter: Nguyen Tuan Hung
Impact: moderate

References

Bug 2079311

#CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Reporter: Mozilla
Impact: moderate

References

Bug 2079501

#CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts component

Reporter: Mozilla
Impact: moderate

References

Bug 2079686

#CVE-2026-117992: Information disclosure in the CSS Parsing and Computation component

Reporter: Takashi Suzuki
Impact: moderate

References

Bug 2079709

#CVE-2026-117993: Integer overflow in the Graphics: Text component

Reporter: 5up3rh3i
Impact: moderate

References

Bug 2080581

#CVE-2026-117994: Use-after-free in the JavaScript: GC component

Reporter: Mozilla
Impact: moderate

References

Bug 2080787

#CVE-2026-117995: Privilege escalation in the DOM: UI Events & Focus Handling component

Reporter: haruka yamazaki
Impact: moderate

References

Bug 2081184

#CVE-2026-117996: Incorrect boundary conditions in the WebRTC component

Reporter: Mozilla
Impact: moderate

References

Bug 2081535

#CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component

Reporter: Mozilla
Impact: moderate

References

Bug 2081560

#CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component

Reporter: Ibuki Sato
Impact: low

References

Bug 2042021

#CVE-2026-117999: Race condition in the IPC component

Reporter: Mozilla
Impact: low

References

Bug 2071379

#CVE-2026-118000: Information disclosure in the Networking: HTTP component

Reporter: Mozilla
Impact: low

References

Bug 2072436

#CVE-2026-118002: Information disclosure due to race condition in the Networking component

Reporter: Abdulrahman Alzahrani
Impact: low

References

Bug 2073584

#CVE-2026-118003: Information disclosure in the Networking: DNS component

Reporter: eldjiikgull
Impact: low

References

Bug 2076744

#CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and Animations component

Reporter: Mozilla
Impact: low

References

Bug 2077756