Mozilla Foundation Security Advisory 2026-75
Security Vulnerabilities fixed in Firefox ESR 115.39
- Announced
- August 18, 2026
- Impact
- high
- Products
- Firefox ESR
- Fixed in
-
- Firefox ESR 115.39
#CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
- Reporter
- satyamasd
- Impact
- high
References
#CVE-2026-74935: Privilege escalation in the DOM: Networking component
- Reporter
- Yaqoub Aldurayhim
- Impact
- high
References
#CVE-2026-74939: Privilege escalation in the DOM: Navigation component
- Reporter
- choeseyeong
- Impact
- high
References
#CVE-2026-74940: Use-after-free in the Graphics: Text component
- Reporter
- kiyong
- Impact
- high
References
#CVE-2026-74942: Privilege escalation in the Remote Settings Client component
- Reporter
- Gal Ankonina
- Impact
- high
References
#CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
- Reporter
- Abdulaziz Alasaiqah
- Impact
- high
References
#CVE-2026-74945: Information disclosure in the Graphics: Text component
- Reporter
- Abdulaziz Alasaiqah
- Impact
- high
References
#CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- locust1b
- Impact
- high
References
#CVE-2026-74948: Information disclosure in the Graphics component
- Reporter
- Yaqoub Aldurayhim
- Impact
- high
References
#CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
- Reporter
- Hyeonjun Ahn
- Impact
- moderate
References
#CVE-2026-74973: Race condition, use-after-free in the Graphics component
- Reporter
- r00tdaddy
- Impact
- moderate
References
#CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component
- Reporter
- The Mozilla Fuzzing Team
- Impact
- moderate
References
#CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Reporter
- Christian Holler, Jan de Mooij, Tom Ritter and the Mozilla Fuzzing Team
- Impact
- high
Description
Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.