RHSA-2026:3491 Red Hat Security Advisory: firefox security update
libvpx: Heap buffer overflow in libvpx firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component firefox: thunderbird: Use-after-free in the JavaScript: GC component firefox: thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component firefox: thunderbird: Sandbox escape in the Graphics: WebRender component firefox: thunderbird: Integer overflow in the JavaScript: Standard Library component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component firefox: thunderbird: Sandbox escape in the Storage: IndexedDB component firefox: thunderbird: Use-after-free in the Storage: IndexedDB component firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component firefox: thunderbird: Undefined behavior in the DOM: Core & HTML component firefox: thunderbird: Use-after-free in the Audio/Video: Playback component firefox: thunderbird: Incorrect boundary conditions in the Web Audio component firefox: thunderbird: Integer overflow in the Audio/Video component firefox: thunderbird: Mitigation bypass in the DOM: HTML Parser component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software firefox: thunderbird: Privilege escalation in the Messaging System component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component firefox: thunderbird: Incorrect boundary conditions in the Networking: JAR component firefox: thunderbird: Privilege escalation in the Netmonitor component firefox: thunderbird: Integer overflow in the Libraries component in NSS firefox: thunderbird: Privilege escalation in the Netmonitor component firefox: thunderbird: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Invalid pointer in the JavaScript Engine component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: Use-after-free in the DOM: Window and Location component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component firefox: thunderbird: Use-after-free in the Graphics: ImageLib component firefox: thunderbird: Same-origin policy bypass in the Networking: JAR component firefox: thunderbird: Mitigation bypass in the Networking: Cache component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
CVSS v3.1 score: 7.5