Mozilla Foundation Security Advisory 2026-47
Security Vulnerabilities fixed in Firefox ESR 115.36
- Announced
- May 19, 2026
- Impact
- high
- Products
- Firefox ESR
- Fixed in
-
- Firefox ESR 115.36
#CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component
- Reporter
- zx
- Impact
- high
References
#CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component
- Reporter
- ggwhyp
- Impact
- high
References
#CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component
- Reporter
- Satoki Tsuji
- Impact
- high
References
#CVE-2026-8391: Other issue in the JavaScript Engine component
- Reporter
- ggwhyp
- Impact
- high
References
#CVE-2026-8401: Sandbox escape in the Profile Backup component
- Reporter
- ggwhyp
- Impact
- high
References
#CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access APIs component
- Reporter
- stevej
- Impact
- moderate
References
#CVE-2026-8975: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151
- Reporter
- Andrew McCreight, Valentin Gosu, Nika Layzell, Tom Schuster and the Mozilla Fuzzing Team
- Impact
- high
Description
Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.