Mozilla
Security Vulnerabilities fixed in Firefox ESR 153.6
MFSA2026-120 Oct 27, 2026 Source: Vendor
Imported from Mozilla security advisory MFSA2026-120. Draft.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
145 lines
Showing 1–50 of 145 , page 1 of 3
CVE-2026-117860
BR2026-0000-036828
unclaimed
High: Same-origin policy bypass in the DOM: Navigation component
Credited as satyamasd
CVE-2026-117861
BR2026-0000-036829
unclaimed
High: Sandbox escape in the DOM: Navigation component
Credited as Mozilla
CVE-2026-117862
BR2026-0000-036830
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Networking component
Credited as Mozilla
CVE-2026-117863
BR2026-0000-036831
unclaimed
High: Information disclosure due to uninitialized memory in the Audio/Video component
Credited as Mozilla
CVE-2026-117864
BR2026-0000-036832
unclaimed
High: Sandbox escape in the Form Manager component
Credited as Mozilla
CVE-2026-117865
BR2026-0000-036833
unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117866
BR2026-0000-036834
unclaimed
High: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117867
BR2026-0000-036835
unclaimed
High: Use-after-free in the Layout component
Credited as Mozilla
CVE-2026-117868
BR2026-0000-036836
unclaimed
High: Sandbox escape in the DOM: Networking component
Credited as Yaqoub Aldurayhim
CVE-2026-117869
BR2026-0000-036837
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117870
BR2026-0000-036838
unclaimed
High: Use-after-free in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117871
BR2026-0000-036839
unclaimed
High: Invalid pointer in the Graphics component
Credited as Mozilla
CVE-2026-117872
BR2026-0000-036840
unclaimed
High: Use-after-free in the JavaScript: Standard Library component
Credited as Mozilla
CVE-2026-117873
BR2026-0000-036841
unclaimed
High: Incorrect boundary conditions in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117874
BR2026-0000-036842
unclaimed
High: Use-after-free in the Internationalization component
Credited as Mozilla
CVE-2026-117875
BR2026-0000-036843
unclaimed
High: Use-after-free in the Layout: Scrolling and Overflow component
Credited as Mozilla
CVE-2026-117876
BR2026-0000-036844
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Amy Burnett of OpenAI
CVE-2026-117877
BR2026-0000-036845
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117878
BR2026-0000-036846
unclaimed
High: Other issue, use-after-free in the Storage: IndexedDB component
Credited as Amy Burnett of OpenAI
CVE-2026-117879
BR2026-0000-036847
unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Amy Burnett of OpenAI
CVE-2026-117880
BR2026-0000-036848
unclaimed
High: Use-after-free in the XML component
Credited as Mozilla
CVE-2026-117881
BR2026-0000-036849
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Amy Burnett of OpenAI
CVE-2026-117882
BR2026-0000-036850
unclaimed
High: Use-after-free in the Layout component
Credited as Amy Burnett of OpenAI
CVE-2026-117883
BR2026-0000-036851
unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Amy Burnett of OpenAI
CVE-2026-117884
BR2026-0000-036852
unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117885
BR2026-0000-036853
unclaimed
High: Use-after-free in the Layout: Grid component
Credited as Mozilla
CVE-2026-117886
BR2026-0000-036854
unclaimed
High: Incorrect boundary conditions in the Graphics: Text component
Credited as tsui
CVE-2026-117887
BR2026-0000-036855
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117888
BR2026-0000-036856
unclaimed
High: Uninitialized memory in the Graphics: Canvas2D component
Credited as Minseong Kim
CVE-2026-117889
BR2026-0000-036857
unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117890
BR2026-0000-036858
unclaimed
High: JIT miscompilation in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117891
BR2026-0000-036859
unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117892
BR2026-0000-036860
unclaimed
High: Privilege escalation due to use-after-free in the WebRTC: Networking component
Credited as Mozilla
CVE-2026-117893
BR2026-0000-036861
unclaimed
High: Incorrect boundary conditions in the Security: PSM component
Credited as Mozilla
CVE-2026-117894
BR2026-0000-036862
unclaimed
High: Incorrect boundary conditions in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117895
BR2026-0000-036863
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117896
BR2026-0000-036864
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117897
BR2026-0000-036865
unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Mozilla
CVE-2026-117898
BR2026-0000-036866
unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117899
BR2026-0000-036867
unclaimed
High: Use-after-free in the Networking: HTTP component
Credited as Mozilla
CVE-2026-117900
BR2026-0000-036868
unclaimed
High: Use-after-free in the DOM: Editor component
Credited as Mozilla
CVE-2026-117901
BR2026-0000-036869
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117902
BR2026-0000-036870
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117903
BR2026-0000-036871
unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-117904
BR2026-0000-036872
unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117905
BR2026-0000-036873
unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117906
BR2026-0000-036874
unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as Mozilla
CVE-2026-117907
BR2026-0000-036875
unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117908
BR2026-0000-036876
unclaimed
High: Use-after-free in the Graphics: ImageLib component
Credited as Mozilla
CVE-2026-117909
BR2026-0000-036877
unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla