Security Vulnerabilities fixed in Firefox ESR 140.16 — Mozilla

Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component Reporter...

PT-2026-91941

Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

PT-2026-91953

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

PT-2026-92001

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

PT-2026-92006

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

PT-2026-91952

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

PT-2026-91954

Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

PT-2026-91965

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

PT-2026-91966

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

PT-2026-91972

Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

PT-2026-92000

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

PT-2026-92003

Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

PT-2026-92010

Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

PT-2026-92012

Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

PT-2026-91988

Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

Mozilla Firefox ESR < 153.3

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-93 advisory. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 a...

PT-2026-91971

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

Mozilla Firefox ESR < 140.16

The version of Firefox ESR installed on the remote Windows host is prior to 140.16. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-92 advisory. - Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerabilit...

PT-2026-91964

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

PT-2026-91948

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...