RHSA-2026:99110HighCVSS 7.5

Red Hat Security Advisory: firefox security update

Published
November 11, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (81)

CVE-2026-124853 →CVE-2026-124864 →CVE-2026-124876 →CVE-2026-124883 →CVE-2026-124903 →CVE-2026-118007 →CVE-2026-124862 →CVE-2026-124863 →CVE-2026-124873 →CVE-2026-124906 →CVE-2026-124910 →CVE-2026-124926 →CVE-2026-124854 →CVE-2026-124884 →CVE-2026-124885 →CVE-2026-124897 →CVE-2026-124899 →CVE-2026-124918 →CVE-2026-124861 →CVE-2026-124913 →CVE-2026-124924 →CVE-2026-124927 →CVE-2026-124855 →CVE-2026-124856 →CVE-2026-124866 →CVE-2026-124888 →CVE-2026-124919 →CVE-2026-124860 →CVE-2026-124869 →CVE-2026-124874 →CVE-2026-124880 →CVE-2026-124881 →CVE-2026-124902 →CVE-2026-124870 →CVE-2026-124894 →CVE-2026-124922 →CVE-2026-124931 →CVE-2026-124941 →CVE-2026-118021 →CVE-2026-124882 →CVE-2026-124898 →CVE-2026-124935 →CVE-2026-124938 →CVE-2026-118019 →CVE-2026-124901 →CVE-2026-124905 →CVE-2026-124909 →CVE-2026-124875 →CVE-2026-124858 →CVE-2026-124865 →CVE-2026-124892 →CVE-2026-124940 →CVE-2026-124886 →CVE-2026-124890 →CVE-2026-124929 →CVE-2026-124933 →CVE-2026-124939 →CVE-2026-124948 →CVE-2026-124887 →CVE-2026-124891 →CVE-2026-124896 →CVE-2026-124912 →CVE-2026-124914 →CVE-2026-124951 →CVE-2026-124879 →CVE-2026-118024 →CVE-2026-124857 →CVE-2026-124868 →CVE-2026-124893 →CVE-2026-124915 →CVE-2026-124917 →CVE-2026-124934 →CVE-2026-124895 →CVE-2026-124907 →CVE-2026-124877 →CVE-2026-124859 →CVE-2026-124872 →CVE-2026-124889 →CVE-2026-124930 →CVE-2026-124942 →CVE-2026-124932 →

📋 Description

CVE-2026-118007 — firefox: thunderbird: Use-after-free in the JavaScript: GC component CVE-2026-118019 — firefox: thunderbird: Race condition, use-after-free in the DOM: File component CVE-2026-118021 — firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component CVE-2026-118024 — firefox: thunderbird: Use-after-free in the Graphics: Text component CVE-2026-124853 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component CVE-2026-124854 — firefox: thunderbird: Privilege escalation in the DOM: Navigation component CVE-2026-124855 — firefox: thunderbird: Sandbox escape in the DOM: Navigation component CVE-2026-124856 — firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component CVE-2026-124857 — firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-124858 — firefox: thunderbird: Use-after-free in the DOM: HTML Parser component CVE-2026-124859 — firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component CVE-2026-124860 — firefox: thunderbird: Use-after-free in the Audio/Video component CVE-2026-124861 — firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component CVE-2026-124862 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-124863 — firefox: thunderbird: Use-after-free in the DOM: HTML Parser component CVE-2026-124864 — firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component CVE-2026-124865 — firefox: thunderbird: Use-after-free in the Audio/Video component CVE-2026-124866 — firefox: thunderbird: Use-after-free in the Layout component CVE-2026-124868 — firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component CVE-2026-124869 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-124870 — firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component CVE-2026-124872 — firefox: thunderbird: Use-after-free in the Cycle Collector component CVE-2026-124873 — firefox: thunderbird: Invalid pointer in the DOM: Editor component CVE-2026-124874 — firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component CVE-2026-124875 — firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component CVE-2026-124876 — firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component CVE-2026-124877 — firefox: thunderbird: Use-after-free in the Layout: Positioned component CVE-2026-124879 — firefox: thunderbird: Invalid pointer in the Networking: Cache component CVE-2026-124880 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-124881 — firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component CVE-2026-124882 — firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component CVE-2026-124883 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-124884 — firefox: thunderbird: Use-after-free in the JavaScript: GC component CVE-2026-124885 — firefox: thunderbird: Use-after-free in the Graphics: Text component CVE-2026-124886 — firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component CVE-2026-124887 — firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component CVE-2026-124888 — firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component CVE-2026-124889 — firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component CVE-2026-124890 — firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVE-2026-124891 — firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component CVE-2026-124892 — firefox: thunderbird: Use-after-free in the JavaScript: GC component CVE-2026-124893 — firefox: thunderbird: Use-after-free in the DOM: Workers component CVE-2026-124894 — firefox: thunderbird: Use-after-free in the Networking: Cookies component CVE-2026-124895 — firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component CVE-2026-124896 — firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component CVE-2026-124897 — firefox: thunderbird: Use-after-free in the JavaScript: GC component CVE-2026-124898 — firefox: thunderbird: Use-after-free in the DOM: Editor component CVE-2026-124899 — firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component CVE-2026-124901 — firefox: thunderbird: Other issue in the Networking: JAR component CVE-2026-124902 — firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component CVE-2026-124903 — firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component CVE-2026-124905 — firefox: thunderbird: Sandbox escape in the DOM: Navigation component CVE-2026-124906 — firefox: thunderbird: Use-after-free in the Graphics: WebRender component CVE-2026-124907 — firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component CVE-2026-124909 — firefox: thunderbird: Information disclosure in the Private Browsing component CVE-2026-124910 — firefox: thunderbird: Mitigation bypass in the WebExtensions component CVE-2026-124912 — firefox: thunderbird: Spoofing issue in the DOM: Security component CVE-2026-124913 — firefox: thunderbird: Site isolation issue in the Networking component CVE-2026-124914 — firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-124915 — firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component CVE-2026-124917 — firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component CVE-2026-124918 — firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component CVE-2026-124919 — firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component CVE-2026-124922 — firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component CVE-2026-124924 — firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component CVE-2026-124926 — firefox: thunderbird: Incorrect boundary conditions in the WebRTC component CVE-2026-124927 — firefox: thunderbird: Site isolation issue in the Graphics: WebRender component CVE-2026-124929 — firefox: thunderbird: Information disclosure in the Layout: Form Controls component CVE-2026-124930 — firefox: thunderbird: Information disclosure in the Address Bar component CVE-2026-124931 — firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component CVE-2026-124932 — firefox: thunderbird: Use-after-free in the Graphics component CVE-2026-124933 — firefox: thunderbird: Sandbox escape in the Console component CVE-2026-124934 — firefox: thunderbird: Spoofing issue in the Security component CVE-2026-124935 — firefox: thunderbird: Undefined behavior in the WebRTC: Networking component CVE-2026-124938 — firefox: thunderbird: Mitigation bypass in the Add-ons Manager component CVE-2026-124939 — firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component CVE-2026-124940 — firefox: thunderbird: Mitigation bypass in the File Handling component CVE-2026-124941 — firefox: thunderbird: Information disclosure in the Security: RLBox component CVE-2026-124942 — firefox: thunderbird: Invalid pointer in the DOM: Streams component CVE-2026-124948 — firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component CVE-2026-124951 — firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-0:153.7.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-0:153.7.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-0:153.7.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-0:153.7.0-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-0:153.7.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debuginfo-0:153.7.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debuginfo-0:153.7.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debuginfo-0:153.7.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debuginfo-0:153.7.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debugsource-0:153.7.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debugsource-0:153.7.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debugsource-0:153.7.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-debugsource-0:153.7.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-x11-0:153.7.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-x11-0:153.7.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-x11-0:153.7.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • firefox-x11-0:153.7.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to disable or restrict JavaScript execution for untrusted web content in client environments: upgrade to Firefox 159, Thunderbird 159, which resolves the use-after-free condition during memory management in the SpiderMonkey JavaScript garbage collection component, closing crafted JavaScript execution triggering garbage collection. Until patched, this is a concern on Clients executing untrusted web content in script-enabled browser contexts across all platforms, so Restrict or disable JavaScript execution in client environments and prevent navigation to untrusted web content. As a compensating measure, Enable Address Space Layout Randomization to randomize process memory targets and impede reliable exploitation. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1309 Script Engine Restriction (Sandbox / Disable) (high) Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Avoid navigating to untrusted websites in Firefox and exercise caution with untrusted HTML emails or unsolicited attachments in Thunderbird. Where application usage is required, isolate browser and mail sessions within a sandboxed environment (such as an unprivileged container or Flatpak sandbox) to constrain potential access to host resources. If graphical web browsing or email processing is not required on the system, remove the affected packages: ``` dnf remove firefox thunderbird ``` Caveat: On graphical desktop installations, removing these packages may remove dependent desktop components or alter desktop environment functionality. Headless or terminal-based server environments will remain unaffected.

🔗 References (84)