Mozilla
Security Vulnerabilities fixed in Firefox ESR 115.42
MFSA2026-98 Sep 29, 2026 Source: Vendor
Imported from Mozilla security advisory MFSA2026-98. Draft.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-98/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
31 lines
Showing 1–31 of 31
CVE-2026-100756
BR2026-0000-019547
unclaimed
High: Incorrect boundary conditions in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-100757
BR2026-0000-019548
unclaimed
High: Use-after-free in the Widget component
Credited as Mohamed Mbarek
CVE-2026-100758
BR2026-0000-019549
unclaimed
High: Sandbox escape in the DOM: Navigation component
Credited as Mozilla
CVE-2026-100759
BR2026-0000-019550
unclaimed
High: Uninitialized memory in the Storage: Quota Manager component
Credited as Mozilla
CVE-2026-100762
BR2026-0000-019551
unclaimed
High: Sandbox escape due to use-after-free in the DOM: Content Processes component
Credited as Yaqoub Aldurayhim
CVE-2026-92035
BR2026-0000-019552
unclaimed
High: Sandbox escape due to incorrect boundary conditions in the Graphics component
Credited as Mozilla
CVE-2026-100766
BR2026-0000-019553
unclaimed
High: Information disclosure in the Networking: JAR component
Credited as Mozilla
CVE-2026-100767
BR2026-0000-019554
unclaimed
High: Use-after-free in the Networking: Cache component
Credited as Mozilla
CVE-2026-100770
BR2026-0000-019555
unclaimed
High: Sandbox escape due to use-after-free in the DOM: Content Processes component
Credited as Mozilla
CVE-2026-100771
BR2026-0000-019556
unclaimed
High: Undefined behavior in the DOM: Streams component
Credited as Mozilla
CVE-2026-100773
BR2026-0000-019557
unclaimed
High: Use-after-free in the Storage: IndexedDB component
Credited as Mozilla
CVE-2026-100774
BR2026-0000-019558
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-100775
BR2026-0000-019559
unclaimed
High: Sandbox escape in the Graphics component
Credited as Mozilla
CVE-2026-100777
BR2026-0000-019560
unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-100778
BR2026-0000-019561
unclaimed
High: Sandbox escape due to use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-100779
BR2026-0000-019562
unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-100780
BR2026-0000-019563
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-100781
BR2026-0000-019564
unclaimed
High: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
Credited as Mozilla
CVE-2026-100782
BR2026-0000-019565
unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Graphics component
Credited as Mozilla
CVE-2026-100783
BR2026-0000-019566
unclaimed
High: Uninitialized memory in the Audio/Video component
Credited as 5up3rh3i
CVE-2026-100784
BR2026-0000-019567
unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as 5up3rh3i
CVE-2026-100785
BR2026-0000-019568
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-100786
BR2026-0000-019569
unclaimed
High: Sandbox escape due to use-after-free in the Graphics component
Credited as Mozilla
CVE-2026-100789
BR2026-0000-019570
unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-100790
BR2026-0000-019571
unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-100791
BR2026-0000-019572
unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-100832
BR2026-0000-019573
unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-100797
BR2026-0000-019574
unclaimed
Moderate: Privilege escalation due to use-after-free in the Graphics: WebRender component
Credited as Mozilla
CVE-2026-100803
BR2026-0000-019575
unclaimed
Moderate: Same-origin policy bypass in the WebExtensions component
Credited as Yaqoub Aldurayhim
CVE-2026-100819
BR2026-0000-019576
unclaimed
Moderate: Sandbox escape due to incorrect boundary conditions in the XPCOM component
Credited as Mozilla
CVE-2026-100821
BR2026-0000-019577
unclaimed
Moderate: Site isolation issue in the Panning and Zooming component
Credited as Nguyen Thanh Nguyen