Mozilla
Security Vulnerabilities fixed in Firefox ESR 115.43
MFSA2026-107 Oct 13, 2026 Source: Vendor
Imported from Mozilla security advisory MFSA2026-107. Draft.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-107/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
17 lines
Showing 1–17 of 17
CVE-2026-109706
BR2026-0000-033867
unclaimed
High: Use-after-free in the Storage: IndexedDB component
Credited as Mozilla
CVE-2026-109710
BR2026-0000-033868
unclaimed
High: Use-after-free in the Graphics: Text component
Credited as Mozilla
CVE-2026-109712
BR2026-0000-033869
unclaimed
High: Sandbox escape due to uninitialized memory in the Graphics component
Credited as Mozilla
CVE-2026-109715
BR2026-0000-033870
unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as Amy Burnett of OpenAI
CVE-2026-109716
BR2026-0000-033871
unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as Amy Burnett of OpenAI
CVE-2026-109718
BR2026-0000-033872
unclaimed
High: Use-after-free in the XML component
Credited as Mozilla
CVE-2026-109719
BR2026-0000-033873
unclaimed
High: Race condition, use-after-free in the Graphics: CanvasWebGL component
Credited as Shu Takahashi of Velcore Consulting Inc.
CVE-2026-109722
BR2026-0000-033874
unclaimed
High: JIT miscompilation in the JavaScript Engine: JIT component
Credited as Amy Burnett of OpenAI
CVE-2026-109725
BR2026-0000-033875
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-109726
BR2026-0000-033876
unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-109727
BR2026-0000-033877
unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-109728
BR2026-0000-033878
unclaimed
High: Use-after-free in the DOM: Animation component
Credited as Amy Burnett of OpenAI
CVE-2026-109729
BR2026-0000-033879
unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Tomer Fichman
CVE-2026-109730
BR2026-0000-033880
unclaimed
High: Integer overflow in the Graphics component
Credited as Robert Longson
CVE-2026-109732
BR2026-0000-033881
unclaimed
High: Use-after-free in the DOM: Streams component
Credited as Mozilla
CVE-2026-109733
BR2026-0000-033882
unclaimed
High: JIT miscompilation in the JavaScript Engine: JIT component
Credited as Amy Burnett of OpenAI
CVE-2026-109753
BR2026-0000-033883
unclaimed
Moderate: Incorrect boundary conditions in the Layout component
Credited as Mozilla