Mozilla
Security Vulnerabilities fixed in Firefox ESR 140.16
MFSA2026-92 Sep 15, 2026 Source: Vendor
Imported from Mozilla security advisory MFSA2026-92. Draft.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-92/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
28 lines
Showing 1–28 of 28 matching , clear filters
CVE-2026-92005
BR2026-0000-042073
unclaimed
High: Use-after-free in the Audio/Video: Web Codecs component
Credited as devdharan9424@gmail.com
CVE-2026-92006
BR2026-0000-042074
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92007
BR2026-0000-042075
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92008
BR2026-0000-042076
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92009
BR2026-0000-042077
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92010
BR2026-0000-042078
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92011
BR2026-0000-042079
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92012
BR2026-0000-042080
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92013
BR2026-0000-042081
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-92014
BR2026-0000-042082
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics component
Credited as Jacolon Walker
CVE-2026-92015
BR2026-0000-042083
unclaimed
High: Privilege escalation in the WebExtensions component
Credited as Quy Pham
CVE-2026-92016
BR2026-0000-042084
unclaimed
High: Use-after-free in the Disability Access APIs component
Credited as Mozilla
CVE-2026-92017
BR2026-0000-042085
unclaimed
High: Privilege escalation in the DOM: Service Workers component
Credited as Mozilla
CVE-2026-92018
BR2026-0000-042086
unclaimed
High: Sandbox escape in the DOM: Core & HTML component
Credited as Quy Pham
CVE-2026-92020
BR2026-0000-042087
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
Credited as Rintaro Kawasugi
CVE-2026-92021
BR2026-0000-042088
unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Tomer Fichman
CVE-2026-92022
BR2026-0000-042089
unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Seohyeon Maeng
CVE-2026-92023
BR2026-0000-042090
unclaimed
High: Use-after-free in the XML component
Credited as Mozilla
CVE-2026-92024
BR2026-0000-042091
unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-92025
BR2026-0000-042092
unclaimed
High: Use-after-free in the DOM: Navigation component
Credited as Mozilla
CVE-2026-92026
BR2026-0000-042093
unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-92027
BR2026-0000-042094
unclaimed
High: Use-after-free in the DOM: Streams component
Credited as Mozilla
CVE-2026-92028
BR2026-0000-042095
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-92029
BR2026-0000-042096
unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-92030
BR2026-0000-042097
unclaimed
Moderate: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
Credited as anas cherni
CVE-2026-92019
BR2026-0000-042098
unclaimed
Moderate: Mitigation bypass in the Remote Settings Client component
Credited as Shu Takahashi
CVE-2026-92031
BR2026-0000-042099
unclaimed
Moderate: Information disclosure in the Graphics: ImageLib component
Credited as Qi Qin
CVE-2026-92032
BR2026-0000-042100
unclaimed
Moderate: Sandbox escape due to invalid pointer in the Graphics component
Credited as Mozilla