SB2026101619 - Debian update for firefox-esr
Published: October 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 59 vulnerabilities.
1) Protection mechanism failure (CVE-ID: CVE-2026-109760)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass HTTP-related security protections.
The vulnerability exists due to a protection mechanism failure in the Networking: HTTP component when processing HTTP traffic. A remote attacker can trigger affected HTTP processing to evade an intended security restriction.
2) Protection mechanism failure (CVE-ID: CVE-2026-109737)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security restrictions enforced through enterprise policies.
The vulnerability exists due to a protection mechanism failure in the Enterprise Policies component when enforcing policy-controlled restrictions. A remote attacker can trigger affected policy handling to evade an intended security restriction.
3) Use-after-free (CVE-ID: CVE-2026-109738)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the Audio/Video: Playback component when handling media playback. A remote attacker can trigger access to freed memory through crafted playback operations to cause a crash and potentially execute arbitrary code.
4) Use-after-free (CVE-ID: CVE-2026-109741)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the Storage: Bucket File System component when handling storage operations. A remote attacker can trigger access to freed memory through crafted storage operations to cause a crash and potentially execute arbitrary code.
5) Information disclosure (CVE-ID: CVE-2026-109742)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to inadequate protection of information in the PDF Viewer component when processing PDF content. A remote attacker can trigger affected viewer behavior through crafted content to obtain information that should not be exposed.
6) Improper privilege management (CVE-ID: CVE-2026-109743)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to improper privilege management in the Panning and Zooming component when handling panning and zooming operations. A remote attacker can trigger affected operations to gain privileges beyond those intended.
7) Protection mechanism failure (CVE-ID: CVE-2026-109744)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in DOM: file component. A remote attacker can bypass implemented security restrictions.
8) Use of uninitialized resource (CVE-ID: CVE-2026-109745)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escape sandbox restrictions.
The vulnerability exists due to use of uninitialized memory in the DOM: Web Serial component when processing serial API operations. A remote attacker can trigger use of memory whose contents have not been initialized to bypass sandbox boundaries.
9) Information disclosure (CVE-ID: CVE-2026-109751)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to inadequate protection of information in the Networking component when handling network operations. A remote attacker can trigger affected network processing to obtain information that should not be exposed.
10) Use-after-free (CVE-ID: CVE-2026-109752)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the DOM: Workers component when handling worker operations. A remote attacker can trigger access to freed memory through crafted worker operations to cause a crash and potentially execute arbitrary code.
11) Buffer overflow (CVE-ID: CVE-2026-109753)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through improper boundary handling.
The vulnerability exists due to incorrect boundary conditions in the Layout component when laying out web content. A remote attacker can supply crafted web content that exercises incorrectly handled boundaries to potentially disrupt browser operation.
12) Input validation error (CVE-ID: CVE-2026-109754)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger unintended document-editing behavior that may compromise browser security.
The vulnerability exists due to incorrect boundary validation in the DOM: Editor component when handling document-editing operations. A remote attacker can trigger crafted editing operations that exercise improperly handled boundary conditions to produce behavior outside intended processing limits.
13) Improper privilege management (CVE-ID: CVE-2026-109756)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to improper privilege management in the DOM: Navigation component when handling document navigation. A remote attacker can trigger affected navigation operations to gain privileges beyond those intended.
14) Race condition (CVE-ID: CVE-2026-109757)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escape sandbox restrictions.
The vulnerability exists due to a race condition in the Networking component when coordinating concurrent network operations. A remote attacker can trigger affected operations with conflicting timing to bypass sandbox boundaries.
15) Improper access control (CVE-ID: CVE-2026-109759)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass site isolation and potentially access resources across site boundaries.
The vulnerability exists due to inadequate enforcement of site-isolation boundaries in the Networking component when handling network operations. A remote attacker can trigger affected network processing to cross boundaries intended to separate different sites.
16) Protection mechanism failure (CVE-ID: CVE-2026-109736)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to undermine layout frame memory-safety protections.
The vulnerability exists due to a frame-poisoning protection failure in the Layout component when handling layout frame memory. A remote attacker can trigger affected layout operations to undermine the intended protection against unsafe frame memory access.
17) Input validation error (CVE-ID: CVE-2026-109762)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger unintended graphics processing behavior that may compromise browser security.
The vulnerability exists due to incorrect boundary validation in the SVG component when processing scalable vector graphics. A remote attacker can supply crafted graphics content that exercises improperly handled boundary conditions to trigger behavior outside intended processing limits.
18) Protection mechanism failure (CVE-ID: CVE-2026-109763)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass file-handling security protections.
The vulnerability exists due to a protection mechanism failure in the File Handling component when processing files. A remote attacker can trigger affected file-handling operations to evade an intended security restriction.
19) Protection mechanism failure (CVE-ID: CVE-2026-109764)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security restrictions enforced through enterprise policies.
The vulnerability exists due to a protection mechanism failure in the Enterprise Policies component when enforcing policy-controlled restrictions. A remote attacker can trigger affected policy handling to evade an intended security restriction.
20) Use-after-free (CVE-ID: CVE-2026-109765)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free associated with a race condition in the Graphics: Text component when handling concurrent text graphics operations. A remote attacker can trigger affected operations with conflicting timing to access freed memory, causing a crash and potentially arbitrary code execution.
21) Protection mechanism failure (CVE-ID: CVE-2026-109766)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security restrictions enforced through enterprise policies.
The vulnerability exists due to a protection mechanism failure in the Enterprise Policies component when enforcing policy-controlled restrictions. A remote attacker can trigger affected policy handling to evade an intended security restriction.
22) Information disclosure (CVE-ID: CVE-2026-109767)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to inadequate protection of information in the Networking component when handling network operations. A remote attacker can trigger affected network processing to obtain information that should not be exposed.
23) Insufficient verification of data authenticity (CVE-ID: CVE-2026-109770)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to misrepresent security-relevant information associated with serial API operations.
The vulnerability exists due to insufficient authenticity enforcement in the DOM: Web Serial component when handling serial API operations. A remote attacker can trigger affected behavior to present misleading information as trustworthy.
24) Input validation error (CVE-ID: CVE-2026-109775)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of operations in the WebRTC component when processing real-time communication activity. A remote attacker can trigger affected processing to disrupt browser functionality or availability.
25) Race condition (CVE-ID: CVE-2026-109776)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger inconsistent component state that may disrupt browser operation.
The vulnerability exists due to a race condition in the XPCOM component when coordinating concurrent operations. A remote attacker can trigger affected operations with conflicting timing to produce inconsistent state and potentially disrupt browser functionality.
26) Information disclosure (CVE-ID: CVE-2026-109777)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to inadequate protection of information in the Storage: IndexedDB component when handling database operations. A remote attacker can trigger affected database processing to obtain information that should not be exposed.
27) Improper privilege management (CVE-ID: CVE-2026-109778)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to improper privilege management in the WebExtensions component when handling extension operations. A remote attacker can trigger affected extension processing to gain privileges beyond those intended.
28) Input validation error (CVE-ID: CVE-2026-109781)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of operations in the Printing: Output component when generating print output. A remote attacker can trigger affected print-output processing to disrupt browser functionality or availability.
29) Protection mechanism failure (CVE-ID: CVE-2026-109782)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass file-handling security protections.
The vulnerability exists due to a protection mechanism failure in the File Handling component when processing files. A remote attacker can trigger affected file-handling operations to evade an intended security restriction.
30) Protection mechanism failure (CVE-ID: CVE-2026-109783)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass file-handling security protections.
The vulnerability exists due to a protection mechanism failure in the File Handling component when processing files. A remote attacker can trigger affected file-handling operations to evade an intended security restriction.
31) Input validation error (CVE-ID: CVE-2026-109721)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger unintended JavaScript execution behavior that may compromise browser security.
The vulnerability exists due to incorrect boundary validation in the JavaScript Engine: JIT component when processing JavaScript for just-in-time execution. A remote attacker can supply crafted JavaScript that exercises improperly handled boundary conditions to trigger behavior outside intended processing limits.
32) Use-after-free (CVE-ID: CVE-2026-109706)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the Storage: IndexedDB component when processing database operations. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
33) Use-after-free (CVE-ID: CVE-2026-109707)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escape sandbox restrictions.
The vulnerability exists due to use-after-free in the Networking component when processing network operations. A remote attacker can trigger access to freed memory in the affected operations to bypass sandbox boundaries.
34) Input validation error (CVE-ID: CVE-2026-109708)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escape sandbox restrictions.
The vulnerability exists due to incorrect boundary validation in the Networking component when handling network operations. A remote attacker can trigger improperly handled boundary conditions to bypass sandbox restrictions.
35) Improper access control (CVE-ID: CVE-2026-109709)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and escalate privileges.
The vulnerability exists due to inadequate enforcement of security boundaries in the Security: Process Sandboxing component when handling sandboxed operations. A remote attacker can exploit the affected boundary enforcement to access information and privileges beyond those intended.
36) Use-after-free (CVE-ID: CVE-2026-109710)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the Graphics: Text component when processing text content. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
37) Use-after-free (CVE-ID: CVE-2026-109711)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the Graphics: Canvas2D component when processing canvas operations. A remote attacker can trigger access to freed memory through crafted canvas operations to cause a crash and potentially execute arbitrary code.
38) Use of Uninitialized Variable (CVE-ID: CVE-2026-109712)
CWE-ID: CWE-457 - Use of Uninitialized Variable
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escape the browser sandbox.
The vulnerability exists due to use of uninitialized memory in the Graphics component when processing graphics data. A remote attacker can trigger the use of uninitialized memory during graphics processing to bypass the browser sandbox restrictions.
39) Use-after-free (CVE-ID: CVE-2026-109713)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the Crash Reporting component when handling crash-reporting operations. A remote attacker can trigger access to freed memory during affected operations to cause a crash and potentially execute arbitrary code.
40) Buffer overflow (CVE-ID: CVE-2026-109715)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through improper boundary handling.
The vulnerability exists due to incorrect boundary conditions in the JavaScript Engine component when processing JavaScript. A remote attacker can supply crafted JavaScript that exercises incorrectly handled boundaries to potentially disrupt browser operation.
41) Buffer overflow (CVE-ID: CVE-2026-109716)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through improper boundary handling.
The vulnerability exists due to incorrect boundary conditions in the JavaScript Engine component when processing JavaScript. A remote attacker can supply crafted JavaScript that exercises incorrectly handled boundaries to potentially disrupt browser operation.
42) Use-after-free (CVE-ID: CVE-2026-109717)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the DOM: Bindings (WebIDL) component when handling web API bindings. A remote attacker can trigger access to freed memory through crafted binding operations to cause a crash and potentially execute arbitrary code.
43) Use-after-free (CVE-ID: CVE-2026-109718)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the XML component when processing XML content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
44) Use-after-free (CVE-ID: CVE-2026-109719)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to a race condition leading to use-after-free in the Graphics: CanvasWebGL component when processing WebGL operations. A remote attacker can supply crafted web content that triggers the race and subsequent access to freed memory to crash the browser or potentially execute arbitrary code.
45) Improper Interaction Between Multiple Correctly-Behaving Entities (CVE-ID: CVE-2026-109720)
CWE-ID: CWE-435 - Improper Interaction Between Multiple Correctly-Behaving Entities
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger incorrect execution of WebAssembly code that may compromise browser security.
The vulnerability exists due to incorrect just-in-time code generation in the JavaScript: WebAssembly component when compiling WebAssembly. A remote attacker can supply crafted WebAssembly that is miscompiled to produce execution behavior inconsistent with the intended program semantics.
46) Use-after-free (CVE-ID: CVE-2026-109705)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escape sandbox restrictions and bypass site isolation.
The vulnerability exists due to use-after-free and incorrect boundary handling in the Networking component when processing network operations. A remote attacker can trigger the affected memory access and boundary checks to cross sandbox and site-isolation boundaries.
47) Input validation error (CVE-ID: CVE-2026-109722)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disrupt correct JavaScript execution and potentially compromise browser security.
The vulnerability exists due to incorrect just-in-time compilation in the JavaScript Engine: JIT component when compiling JavaScript. A remote attacker can supply crafted JavaScript that triggers miscompilation to produce incorrect execution behavior that may undermine browser security.
48) Integer overflow (CVE-ID: CVE-2026-109723)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger incorrect arithmetic results that may cause a denial of service or memory corruption.
The vulnerability exists due to integer overflow in the Layout: Text and Fonts component when performing text and font layout calculations. A remote attacker can supply crafted content that causes a calculation to exceed its integer range to produce incorrect values that may disrupt processing or memory handling.
49) Use-after-free (CVE-ID: CVE-2026-109724)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the DOM: Core & HTML component when handling document operations. A remote attacker can trigger access to freed memory through crafted document operations to cause a crash and potentially execute arbitrary code.
50) Use-after-free (CVE-ID: CVE-2026-109725)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the DOM: Core & HTML component when processing document content. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
51) Use-after-free (CVE-ID: CVE-2026-109726)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the SVG component when processing SVG content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
52) Use-after-free (CVE-ID: CVE-2026-109727)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the Audio/Video component when processing media content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
53) Use-after-free (CVE-ID: CVE-2026-109728)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the DOM: Animation component when processing document animations. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
54) Use-after-free (CVE-ID: CVE-2026-109729)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the JavaScript Engine: JIT component when handling just-in-time compilation of JavaScript. A remote attacker can supply crafted JavaScript that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
55) Integer overflow (CVE-ID: CVE-2026-109730)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through incorrect graphics calculations.
The vulnerability exists due to integer overflow in the Graphics component when performing calculations during graphics processing. A remote attacker can supply crafted graphics content that causes an integer calculation to exceed its representable range to potentially disrupt browser operation.
56) Input validation error (CVE-ID: CVE-2026-109731)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger unintended canvas processing behavior that may compromise browser security.
The vulnerability exists due to incorrect boundary validation in the Graphics: Canvas2D component when processing canvas operations. A remote attacker can supply crafted canvas operations that exercise improperly handled boundary conditions to trigger behavior outside intended processing limits.
57) Use-after-free (CVE-ID: CVE-2026-109732)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in the DOM: Streams component when processing stream operations. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.
58) Input validation error (CVE-ID: CVE-2026-109733)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disrupt correct JavaScript execution and potentially compromise browser security.
The vulnerability exists due to incorrect just-in-time compilation in the JavaScript Engine: JIT component when compiling JavaScript. A remote attacker can supply crafted JavaScript that triggers miscompilation to produce incorrect execution behavior that may undermine browser security.
59) Protection mechanism failure (CVE-ID: CVE-2026-109734)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass browser security protections.
The vulnerability exists due to a protection mechanism failure in the DOM: Security component when enforcing document security restrictions. A remote attacker can trigger affected document operations to bypass the intended security protection.
Remediation
Install update from vendor's website.