SB20261022527 - openEuler 24.03 LTS SP4 update for firefox

Description

This security bulletin contains information about 81 vulnerabilities.

1) Protection mechanism failure (CVE-ID: CVE-2026-109736)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to undermine layout frame memory-safety protections.

The vulnerability exists due to a frame-poisoning protection failure in the Layout component when handling layout frame memory. A remote attacker can trigger affected layout operations to undermine the intended protection against unsafe frame memory access.

2) Use-after-free (CVE-ID: CVE-2026-109752)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Workers component when handling worker operations. A remote attacker can trigger access to freed memory through crafted worker operations to cause a crash and potentially execute arbitrary code.

3) Information disclosure (CVE-ID: CVE-2026-109751)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to inadequate protection of information in the Networking component when handling network operations. A remote attacker can trigger affected network processing to obtain information that should not be exposed.

4) Use of uninitialized resource (CVE-ID: CVE-2026-109745)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to use of uninitialized memory in the DOM: Web Serial component when processing serial API operations. A remote attacker can trigger use of memory whose contents have not been initialized to bypass sandbox boundaries.

5) Protection mechanism failure (CVE-ID: CVE-2026-109744)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in DOM: file component. A remote attacker can bypass implemented security restrictions.

6) Improper privilege management (CVE-ID: CVE-2026-109743)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the Panning and Zooming component when handling panning and zooming operations. A remote attacker can trigger affected operations to gain privileges beyond those intended.

7) Information disclosure (CVE-ID: CVE-2026-109742)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to inadequate protection of information in the PDF Viewer component when processing PDF content. A remote attacker can trigger affected viewer behavior through crafted content to obtain information that should not be exposed.

8) Use-after-free (CVE-ID: CVE-2026-109741)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Storage: Bucket File System component when handling storage operations. A remote attacker can trigger access to freed memory through crafted storage operations to cause a crash and potentially execute arbitrary code.

9) Input validation error (CVE-ID: CVE-2026-109740)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to incorrect boundary validation in the Widget: Win32 component when handling widget operations. A remote attacker can trigger improperly handled boundary conditions to bypass sandbox restrictions.

10) Use-after-free (CVE-ID: CVE-2026-109738)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Audio/Video: Playback component when handling media playback. A remote attacker can trigger access to freed memory through crafted playback operations to cause a crash and potentially execute arbitrary code.

11) Protection mechanism failure (CVE-ID: CVE-2026-109737)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security restrictions enforced through enterprise policies.

The vulnerability exists due to a protection mechanism failure in the Enterprise Policies component when enforcing policy-controlled restrictions. A remote attacker can trigger affected policy handling to evade an intended security restriction.

12) Buffer overflow (CVE-ID: CVE-2026-109753)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through improper boundary handling.

The vulnerability exists due to incorrect boundary conditions in the Layout component when laying out web content. A remote attacker can supply crafted web content that exercises incorrectly handled boundaries to potentially disrupt browser operation.

13) Protection mechanism failure (CVE-ID: CVE-2026-109734)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass browser security protections.

The vulnerability exists due to a protection mechanism failure in the DOM: Security component when enforcing document security restrictions. A remote attacker can trigger affected document operations to bypass the intended security protection.

14) Input validation error (CVE-ID: CVE-2026-109733)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disrupt correct JavaScript execution and potentially compromise browser security.

The vulnerability exists due to incorrect just-in-time compilation in the JavaScript Engine: JIT component when compiling JavaScript. A remote attacker can supply crafted JavaScript that triggers miscompilation to produce incorrect execution behavior that may undermine browser security.

15) Use-after-free (CVE-ID: CVE-2026-109732)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Streams component when processing stream operations. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

16) Input validation error (CVE-ID: CVE-2026-109731)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger unintended canvas processing behavior that may compromise browser security.

The vulnerability exists due to incorrect boundary validation in the Graphics: Canvas2D component when processing canvas operations. A remote attacker can supply crafted canvas operations that exercise improperly handled boundary conditions to trigger behavior outside intended processing limits.

17) Integer overflow (CVE-ID: CVE-2026-109730)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through incorrect graphics calculations.

The vulnerability exists due to integer overflow in the Graphics component when performing calculations during graphics processing. A remote attacker can supply crafted graphics content that causes an integer calculation to exceed its representable range to potentially disrupt browser operation.

18) Use-after-free (CVE-ID: CVE-2026-109729)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the JavaScript Engine: JIT component when handling just-in-time compilation of JavaScript. A remote attacker can supply crafted JavaScript that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

19) Use-after-free (CVE-ID: CVE-2026-109728)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Animation component when processing document animations. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

20) Use-after-free (CVE-ID: CVE-2026-109727)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Audio/Video component when processing media content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

21) Use-after-free (CVE-ID: CVE-2026-109726)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the SVG component when processing SVG content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

22) Protection mechanism failure (CVE-ID: CVE-2026-109766)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security restrictions enforced through enterprise policies.

The vulnerability exists due to a protection mechanism failure in the Enterprise Policies component when enforcing policy-controlled restrictions. A remote attacker can trigger affected policy handling to evade an intended security restriction.

23) Protection mechanism failure (CVE-ID: CVE-2026-109783)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass file-handling security protections.

The vulnerability exists due to a protection mechanism failure in the File Handling component when processing files. A remote attacker can trigger affected file-handling operations to evade an intended security restriction.

24) Protection mechanism failure (CVE-ID: CVE-2026-109782)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass file-handling security protections.

The vulnerability exists due to a protection mechanism failure in the File Handling component when processing files. A remote attacker can trigger affected file-handling operations to evade an intended security restriction.

25) Input validation error (CVE-ID: CVE-2026-109781)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of operations in the Printing: Output component when generating print output. A remote attacker can trigger affected print-output processing to disrupt browser functionality or availability.

26) Improper privilege management (CVE-ID: CVE-2026-109778)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the WebExtensions component when handling extension operations. A remote attacker can trigger affected extension processing to gain privileges beyond those intended.

27) Information disclosure (CVE-ID: CVE-2026-109777)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to inadequate protection of information in the Storage: IndexedDB component when handling database operations. A remote attacker can trigger affected database processing to obtain information that should not be exposed.

28) Race condition (CVE-ID: CVE-2026-109776)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger inconsistent component state that may disrupt browser operation.

The vulnerability exists due to a race condition in the XPCOM component when coordinating concurrent operations. A remote attacker can trigger affected operations with conflicting timing to produce inconsistent state and potentially disrupt browser functionality.

29) Input validation error (CVE-ID: CVE-2026-109775)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of operations in the WebRTC component when processing real-time communication activity. A remote attacker can trigger affected processing to disrupt browser functionality or availability.

30) Insufficient verification of data authenticity (CVE-ID: CVE-2026-109770)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to misrepresent security-relevant information associated with serial API operations.

The vulnerability exists due to insufficient authenticity enforcement in the DOM: Web Serial component when handling serial API operations. A remote attacker can trigger affected behavior to present misleading information as trustworthy.

31) Information disclosure (CVE-ID: CVE-2026-109767)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to inadequate protection of information in the Networking component when handling network operations. A remote attacker can trigger affected network processing to obtain information that should not be exposed.

32) Use-after-free (CVE-ID: CVE-2026-109725)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when processing document content. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

33) Use-after-free (CVE-ID: CVE-2026-109765)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free associated with a race condition in the Graphics: Text component when handling concurrent text graphics operations. A remote attacker can trigger affected operations with conflicting timing to access freed memory, causing a crash and potentially arbitrary code execution.

34) Protection mechanism failure (CVE-ID: CVE-2026-109764)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security restrictions enforced through enterprise policies.

The vulnerability exists due to a protection mechanism failure in the Enterprise Policies component when enforcing policy-controlled restrictions. A remote attacker can trigger affected policy handling to evade an intended security restriction.

35) Protection mechanism failure (CVE-ID: CVE-2026-109763)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass file-handling security protections.

The vulnerability exists due to a protection mechanism failure in the File Handling component when processing files. A remote attacker can trigger affected file-handling operations to evade an intended security restriction.

36) Input validation error (CVE-ID: CVE-2026-109762)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger unintended graphics processing behavior that may compromise browser security.

The vulnerability exists due to incorrect boundary validation in the SVG component when processing scalable vector graphics. A remote attacker can supply crafted graphics content that exercises improperly handled boundary conditions to trigger behavior outside intended processing limits.

37) Protection mechanism failure (CVE-ID: CVE-2026-109760)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass HTTP-related security protections.

The vulnerability exists due to a protection mechanism failure in the Networking: HTTP component when processing HTTP traffic. A remote attacker can trigger affected HTTP processing to evade an intended security restriction.

38) Improper access control (CVE-ID: CVE-2026-109759)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass site isolation and potentially access resources across site boundaries.

The vulnerability exists due to inadequate enforcement of site-isolation boundaries in the Networking component when handling network operations. A remote attacker can trigger affected network processing to cross boundaries intended to separate different sites.

39) Race condition (CVE-ID: CVE-2026-109757)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to a race condition in the Networking component when coordinating concurrent network operations. A remote attacker can trigger affected operations with conflicting timing to bypass sandbox boundaries.

40) Improper privilege management (CVE-ID: CVE-2026-109756)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the DOM: Navigation component when handling document navigation. A remote attacker can trigger affected navigation operations to gain privileges beyond those intended.

41) Input validation error (CVE-ID: CVE-2026-109754)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger unintended document-editing behavior that may compromise browser security.

The vulnerability exists due to incorrect boundary validation in the DOM: Editor component when handling document-editing operations. A remote attacker can trigger crafted editing operations that exercise improperly handled boundary conditions to produce behavior outside intended processing limits.

42) Use-after-free (CVE-ID: CVE-2026-100815)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error in the CSS Parsing and Computation component. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

43) Use-after-free (CVE-ID: CVE-2026-100831)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error in the DOM: UI Events & Focus Handling component. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

44) Protection mechanism failure (CVE-ID: CVE-2026-100830)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security mitigation.

The vulnerability exists due to improper security control enforcement in the DOM: Navigation component when the component is used. A remote attacker can interact with the affected component to bypass a security mitigation.

45) Protection mechanism failure (CVE-ID: CVE-2026-100829)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security mitigation.

The vulnerability exists due to improper security control enforcement in the DOM: Security component when the component is used. A remote attacker can interact with the affected component to bypass a security mitigation.

46) Protection mechanism failure (CVE-ID: CVE-2026-100828)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security mitigation.

The vulnerability exists due to improper security control enforcement in the Bookmarks & History component when the component is used. A remote attacker can interact with the affected component to bypass a security mitigation.

47) Resource exhaustion (CVE-ID: CVE-2026-100826)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unspecified flaw in the Storage: StorageManager component when the component is used. A remote attacker can interact with the affected component to cause a denial of service.

48) Use-after-free (CVE-ID: CVE-2026-100825)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser. 

The vulnerability exists due to a use-after-free error in the JavaScript Engine: JIT component. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

49) Improper privilege management (CVE-ID: CVE-2026-100824)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to an unspecified flaw in the Places component when the component is used. A remote attacker can interact with the affected component to escalate privileges.

50) Spoofing attack (CVE-ID: CVE-2026-100822)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to spoof content.

The vulnerability exists due to improper user interface presentation in the Networking: HTTP component when the component is used. A remote attacker can interact with the affected component to spoof content.

51) Improper access control (CVE-ID: CVE-2026-100816)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass site isolation.

The vulnerability exists due to improper isolation enforcement in the DOM: Networking component when the component is used. A remote attacker can interact with the affected component to bypass site isolation.

52) Improper privilege management (CVE-ID: CVE-2026-109704)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the Application Update component when handling update-related operations. A remote attacker can exploit the affected operations to gain privileges beyond those intended.

53) Buffer overflow (CVE-ID: CVE-2026-100814)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser. 

The vulnerability exists due to a boundary error in the JavaScript Engine: JIT. A remote attacker can trigger memory corruption and crash the browser. 

54) Resource exhaustion (CVE-ID: CVE-2026-100812)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unspecified flaw in the Graphics component when the component is used. A remote attacker can interact with the affected component to cause a denial of service.

55) Improper access control (CVE-ID: CVE-2026-100809)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass the same-origin policy.

The vulnerability exists due to improper access control in the DevTools component when the component is used. A remote attacker can interact with the affected component to bypass the same-origin policy.

56) Protection mechanism failure (CVE-ID: CVE-2026-100808)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security mitigation.

The vulnerability exists due to improper security control enforcement in the DOM: Service Workers component when the component is used. A remote attacker can interact with the affected component to bypass a security mitigation.

57) Use of Uninitialized Variable (CVE-ID: CVE-2026-100806)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to use of uninitialized memory in the Graphics: WebGPU component. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

58) Use-after-free (CVE-ID: CVE-2026-100800)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to use-after-free in the Disability Access APIs component when the component is used. A remote attacker can trigger the use-after-free to escape the sandbox.

59) Cryptographic issues (CVE-ID: CVE-2026-100798)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to cryptographic issues in Storage: Quota Manager component. A remote attacker can gain access to sensitive information. 

60) Protection mechanism failure (CVE-ID: CVE-2026-100787)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to improper sandbox enforcement in the XUL component when the component is used. A remote attacker can interact with the affected component to escape the sandbox.

61) Use-after-free (CVE-ID: CVE-2026-100765)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the JavaScript: WebAssembly component. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the target system.

62) Buffer overflow (CVE-ID: CVE-2026-109715)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through improper boundary handling.

The vulnerability exists due to incorrect boundary conditions in the JavaScript Engine component when processing JavaScript. A remote attacker can supply crafted JavaScript that exercises incorrectly handled boundaries to potentially disrupt browser operation.

63) Use-after-free (CVE-ID: CVE-2026-109724)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Core & HTML component when handling document operations. A remote attacker can trigger access to freed memory through crafted document operations to cause a crash and potentially execute arbitrary code.

64) Integer overflow (CVE-ID: CVE-2026-109723)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect arithmetic results that may cause a denial of service or memory corruption.

The vulnerability exists due to integer overflow in the Layout: Text and Fonts component when performing text and font layout calculations. A remote attacker can supply crafted content that causes a calculation to exceed its integer range to produce incorrect values that may disrupt processing or memory handling.

65) Input validation error (CVE-ID: CVE-2026-109722)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disrupt correct JavaScript execution and potentially compromise browser security.

The vulnerability exists due to incorrect just-in-time compilation in the JavaScript Engine: JIT component when compiling JavaScript. A remote attacker can supply crafted JavaScript that triggers miscompilation to produce incorrect execution behavior that may undermine browser security.

66) Input validation error (CVE-ID: CVE-2026-109721)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger unintended JavaScript execution behavior that may compromise browser security.

The vulnerability exists due to incorrect boundary validation in the JavaScript Engine: JIT component when processing JavaScript for just-in-time execution. A remote attacker can supply crafted JavaScript that exercises improperly handled boundary conditions to trigger behavior outside intended processing limits.

67) Improper Interaction Between Multiple Correctly-Behaving Entities (CVE-ID: CVE-2026-109720)

CWE-ID: CWE-435 - Improper Interaction Between Multiple Correctly-Behaving Entities

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger incorrect execution of WebAssembly code that may compromise browser security.

The vulnerability exists due to incorrect just-in-time code generation in the JavaScript: WebAssembly component when compiling WebAssembly. A remote attacker can supply crafted WebAssembly that is miscompiled to produce execution behavior inconsistent with the intended program semantics.

68) Use-after-free (CVE-ID: CVE-2026-109719)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to a race condition leading to use-after-free in the Graphics: CanvasWebGL component when processing WebGL operations. A remote attacker can supply crafted web content that triggers the race and subsequent access to freed memory to crash the browser or potentially execute arbitrary code.

69) Use-after-free (CVE-ID: CVE-2026-109718)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the XML component when processing XML content. A remote attacker can supply crafted content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

70) Use-after-free (CVE-ID: CVE-2026-109717)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the DOM: Bindings (WebIDL) component when handling web API bindings. A remote attacker can trigger access to freed memory through crafted binding operations to cause a crash and potentially execute arbitrary code.

71) Buffer overflow (CVE-ID: CVE-2026-109716)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through improper boundary handling.

The vulnerability exists due to incorrect boundary conditions in the JavaScript Engine component when processing JavaScript. A remote attacker can supply crafted JavaScript that exercises incorrectly handled boundaries to potentially disrupt browser operation.

72) Protection mechanism failure (CVE-ID: CVE-2026-100760)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to improper sandbox enforcement in the Security: Process Sandboxing component when the component is used. A remote attacker can interact with the affected component to escape the sandbox.

73) Use-after-free (CVE-ID: CVE-2026-109713)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Crash Reporting component when handling crash-reporting operations. A remote attacker can trigger access to freed memory during affected operations to cause a crash and potentially execute arbitrary code.

74) Use of Uninitialized Variable (CVE-ID: CVE-2026-109712)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape the browser sandbox.

The vulnerability exists due to use of uninitialized memory in the Graphics component when processing graphics data. A remote attacker can trigger the use of uninitialized memory during graphics processing to bypass the browser sandbox restrictions.

75) Use-after-free (CVE-ID: CVE-2026-109711)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Graphics: Canvas2D component when processing canvas operations. A remote attacker can trigger access to freed memory through crafted canvas operations to cause a crash and potentially execute arbitrary code.

76) Use-after-free (CVE-ID: CVE-2026-109710)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Graphics: Text component when processing text content. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

77) Improper access control (CVE-ID: CVE-2026-109709)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and escalate privileges.

The vulnerability exists due to inadequate enforcement of security boundaries in the Security: Process Sandboxing component when handling sandboxed operations. A remote attacker can exploit the affected boundary enforcement to access information and privileges beyond those intended.

78) Input validation error (CVE-ID: CVE-2026-109708)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to incorrect boundary validation in the Networking component when handling network operations. A remote attacker can trigger improperly handled boundary conditions to bypass sandbox restrictions.

79) Use-after-free (CVE-ID: CVE-2026-109707)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to use-after-free in the Networking component when processing network operations. A remote attacker can trigger access to freed memory in the affected operations to bypass sandbox boundaries.

80) Use-after-free (CVE-ID: CVE-2026-109706)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the Storage: IndexedDB component when processing database operations. A remote attacker can supply crafted web content that triggers access to freed memory to crash the browser or potentially execute arbitrary code.

81) Use-after-free (CVE-ID: CVE-2026-109705)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escape sandbox restrictions and bypass site isolation.

The vulnerability exists due to use-after-free and incorrect boundary handling in the Networking component when processing network operations. A remote attacker can trigger the affected memory access and boundary checks to cross sandbox and site-isolation boundaries.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4452