SB2026100912 - Anolis OS update for firefox

Description

This security bulletin contains information about 49 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-92053)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to an unspecified flaw in the Graphics: CanvasWebGL component when processing input. A remote attacker can process input to escalate privileges.

2) Use-after-free (CVE-ID: CVE-2026-92029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the SVG component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to cause memory corruption.

User interaction is required to visit the crafted website.

3) Protection mechanism failure (CVE-ID: CVE-2026-92030)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a mitigation.

The vulnerability exists due to a protection mechanism failure in the DOM: Copy & Paste and Drag & Drop component when processing web content. A remote attacker can exploit the protection mechanism failure to bypass a mitigation.

4) Information disclosure (CVE-ID: CVE-2026-92031)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to information disclosure in the Graphics: ImageLib component when processing web content. A remote attacker can process web content with the affected component to disclose sensitive information.

5) NULL pointer dereference (CVE-ID: CVE-2026-92032)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to an invalid pointer in the Graphics component when processing web content. A remote attacker can trigger the invalid pointer condition to escape the sandbox.

6) Protection mechanism failure (CVE-ID: CVE-2026-92041)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security mitigations.

The vulnerability exists due to a protection mechanism failure in the DOM: Networking component when processing input. A remote attacker can process input to bypass security mitigations.

7) Race condition (CVE-ID: CVE-2026-92042)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause unspecified security impacts.

The vulnerability exists due to a race condition in the DOM: Content Processes component when processing input. A remote attacker can process input to cause unspecified security impacts.

8) Input validation error (CVE-ID: CVE-2026-92043)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Audio/Video component when processing input. A remote attacker can process input to escalate privileges.

9) Input validation error (CVE-ID: CVE-2026-92045)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to incorrect boundary conditions in the WebRTC component when processing input. A remote attacker can process input to escape the sandbox.

10) Use-after-free (CVE-ID: CVE-2026-92046)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Graphics component when processing input. A remote attacker can process input to cause memory corruption.

11) Input validation error (CVE-ID: CVE-2026-92047)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to an unspecified flaw in the Crash Reporting component when processing input. A remote attacker can process input to escalate privileges.

12) Use-after-free (CVE-ID: CVE-2026-92049)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Widget: Win32 component when processing input. A remote attacker can process input to cause memory corruption.

13) Race condition (CVE-ID: CVE-2026-92050)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the browser sandbox.

The vulnerability exists due to a race condition in the XPConnect component when handling affected functionality. A remote attacker can trigger the race condition to escape the browser sandbox.

14) Use-after-free (CVE-ID: CVE-2026-92028)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when processing web content. A remote attacker can trick the victim into visiting a specially crafted website to cause memory corruption.

User interaction is required to visit the crafted website.

15) Input validation error (CVE-ID: CVE-2026-92055)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to an unspecified flaw in the DevTools component when processing input. A remote attacker can process input to escalate privileges.

16) Use-after-free (CVE-ID: CVE-2026-92056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Graphics: Text component when processing input. A remote attacker can process input to cause memory corruption.

17) Protection mechanism failure (CVE-ID: CVE-2026-92057)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security mitigations.

The vulnerability exists due to a protection mechanism failure in the Enterprise Policies component when processing input. A remote attacker can process input to bypass security mitigations.

18) Use-after-free (CVE-ID: CVE-2026-92058)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Graphics component when processing input. A remote attacker can process input to cause memory corruption.

19) Input validation error (CVE-ID: CVE-2026-92059)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause unspecified security impacts.

The vulnerability exists due to incorrect boundary conditions in the DOM: Editor component when processing input. A remote attacker can process input to cause unspecified security impacts.

20) Use-after-free (CVE-ID: CVE-2026-92060)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Internationalization component when processing input. A remote attacker can process input to cause memory corruption.

21) Input validation error (CVE-ID: CVE-2026-92064)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to incorrect boundary conditions in the Widget: Win32 component when processing input. A remote attacker can process input to escape the sandbox.

22) Input validation error (CVE-ID: CVE-2026-92065)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to incorrect boundary conditions in the Widget: Win32 component when processing input. A remote attacker can process input to escape the sandbox.

23) Use-after-free (CVE-ID: CVE-2026-92067)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Widget: Gtk component when processing input. A remote attacker can process input to cause memory corruption.

24) Improper isolation or compartmentalization (CVE-ID: CVE-2026-92068)

CWE-ID: CWE-653 - Improper isolation or compartmentalization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass site isolation.

The vulnerability exists due to improper isolation in the Reader Mode component when processing input. A remote attacker can process input to bypass site isolation.

25) Input validation error (CVE-ID: CVE-2026-92076)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause unspecified security impacts.

The vulnerability exists due to incorrect boundary conditions in the Networking component when processing input. A remote attacker can process input to cause unspecified security impacts.

26) Improper privilege management (CVE-ID: CVE-2026-92015)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the WebExtensions component when processing web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

27) Improper access control (CVE-ID: CVE-2026-75874)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to improper isolation in the Remote Settings Client component when handling remote settings data. A remote attacker can trigger the vulnerable component to escape the sandbox.

28) Use-after-free (CVE-ID: CVE-2026-92005)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the Audio/Video: Web Codecs component when processing web content. A remote attacker can trigger the use-after-free condition to execute arbitrary code.

29) Input validation error (CVE-ID: CVE-2026-92006)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

30) Input validation error (CVE-ID: CVE-2026-92007)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

31) Input validation error (CVE-ID: CVE-2026-92008)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

32) Input validation error (CVE-ID: CVE-2026-92009)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

33) Input validation error (CVE-ID: CVE-2026-92010)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

34) Input validation error (CVE-ID: CVE-2026-92011)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

35) Input validation error (CVE-ID: CVE-2026-92012)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

36) Input validation error (CVE-ID: CVE-2026-92013)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: CanvasWebGL component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

37) Input validation error (CVE-ID: CVE-2026-92014)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

38) Improper privilege management (CVE-ID: CVE-2026-16365)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper access control in the DOM: Workers component when handling worker operations. A remote attacker can trigger crafted worker behavior to escalate privileges.

39) Use-after-free (CVE-ID: CVE-2026-92016)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the Disability Access APIs component when processing web content. A remote attacker can trigger the use-after-free condition to execute arbitrary code.

40) Improper privilege management (CVE-ID: CVE-2026-92017)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the DOM: Service Workers component when processing web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

41) Protection mechanism failure (CVE-ID: CVE-2026-92019)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security mitigation.

The vulnerability exists due to insufficient mitigation enforcement in the Remote Settings Client component when processing web content. A remote attacker can trick the victim into visiting a specially crafted website to bypass a security mitigation.

User interaction is required to visit the crafted website.

42) Input validation error (CVE-ID: CVE-2026-92020)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to incorrect boundary conditions in the Graphics: WebRender component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to escalate privileges.

User interaction is required to visit the crafted website.

43) Use-after-free (CVE-ID: CVE-2026-92021)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the JavaScript Engine: JIT component when processing web content. A remote attacker can trigger the use-after-free condition to execute arbitrary code.

44) Use-after-free (CVE-ID: CVE-2026-92022)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the DOM: HTML Parser component when parsing web content. A remote attacker can trick the victim into visiting a specially crafted website to cause memory corruption.

User interaction is required to visit the crafted website.

45) Use-after-free (CVE-ID: CVE-2026-92023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the XML component when parsing web content. A remote attacker can trick the victim into visiting a specially crafted website to cause memory corruption.

User interaction is required to visit the crafted website.

46) Use-after-free (CVE-ID: CVE-2026-92024)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the SVG component when rendering web content. A remote attacker can trick the victim into visiting a specially crafted website to cause memory corruption.

User interaction is required to visit the crafted website.

47) Use-after-free (CVE-ID: CVE-2026-92025)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the DOM: Navigation component when processing web content. A remote attacker can trick the victim into visiting a specially crafted website to cause memory corruption.

User interaction is required to visit the crafted website.

48) Use-after-free (CVE-ID: CVE-2026-92026)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the Networking component when processing web content. A remote attacker can trigger the use-after-free condition to execute arbitrary code.

49) Use-after-free (CVE-ID: CVE-2026-92027)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the DOM: Streams component when processing web content. A remote attacker can trick the victim into visiting a specially crafted website to cause memory corruption.

User interaction is required to visit the crafted website.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2026:1440