BugRater
Early access. This site has moved to bugrater.com.

Security releases

Mozilla

Security Vulnerabilities fixed in Firefox ESR 153.7

MFSA2026-127 Nov 10, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-127. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-127/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

82 lines
All 82 CVEs 82 Additional recognition 0 Unclaimed only
Showing 1–50 of 82 , page 1 of 2
CVE-2026-124853 BR2026-0000-046205 unclaimed
High: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component
Credited as Mozilla
CVE-2026-124854 BR2026-0000-046206 unclaimed
High: Privilege escalation in the DOM: Navigation component
Credited as Mozilla
CVE-2026-124855 BR2026-0000-046207 unclaimed
High: Sandbox escape in the DOM: Navigation component
Credited as Tran Quac
CVE-2026-124856 BR2026-0000-046208 unclaimed
High: Incorrect boundary conditions in the Networking: HTTP component
Credited as Mozilla
CVE-2026-124857 BR2026-0000-046209 unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-124858 BR2026-0000-046210 unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Amy Burnett of OpenAI
CVE-2026-124859 BR2026-0000-046211 unclaimed
High: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component
Credited as Mozilla
CVE-2026-124860 BR2026-0000-046212 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-124861 BR2026-0000-046213 unclaimed
High: Sandbox escape due to use-after-free in the Audio/Video: cubeb component
Credited as Mozilla
CVE-2026-124862 BR2026-0000-046214 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-118007 BR2026-0000-046215 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-124863 BR2026-0000-046216 unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Mozilla
CVE-2026-124864 BR2026-0000-046217 unclaimed
High: Sandbox escape due to use-after-free in the DOM: Service Workers component
Credited as Mozilla
CVE-2026-124865 BR2026-0000-046218 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-124866 BR2026-0000-046219 unclaimed
High: Use-after-free in the Layout component
Credited as Mozilla
CVE-2026-124868 BR2026-0000-046220 unclaimed
High: Incorrect boundary conditions in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-124869 BR2026-0000-046221 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-124870 BR2026-0000-046222 unclaimed
High: Incorrect boundary conditions in the JavaScript: GC component
Credited as Mozilla
CVE-2026-124872 BR2026-0000-046223 unclaimed
High: Use-after-free in the Cycle Collector component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124873 BR2026-0000-046224 unclaimed
High: Invalid pointer in the DOM: Editor component
Credited as Mozilla
CVE-2026-124874 BR2026-0000-046225 unclaimed
High: Same-origin policy bypass in the Networking: HTTP component
Credited as Minseong Kim
CVE-2026-124875 BR2026-0000-046226 unclaimed
High: Incorrect boundary conditions in the DOM: CSS Object Model component
Credited as Mozilla
CVE-2026-124876 BR2026-0000-046227 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as Mozilla
CVE-2026-124877 BR2026-0000-046228 unclaimed
High: Use-after-free in the Layout: Positioned component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124879 BR2026-0000-046229 unclaimed
High: Invalid pointer in the Networking: Cache component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124880 BR2026-0000-046230 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124881 BR2026-0000-046231 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124882 BR2026-0000-046232 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124883 BR2026-0000-046233 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124884 BR2026-0000-046234 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124885 BR2026-0000-046235 unclaimed
High: Use-after-free in the Graphics: Text component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124886 BR2026-0000-046236 unclaimed
High: Invalid pointer in the Layout: Text and Fonts component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124887 BR2026-0000-046237 unclaimed
High: Incorrect boundary conditions in the Layout: Text and Fonts component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124888 BR2026-0000-046238 unclaimed
High: Incorrect boundary conditions in the Layout: Text and Fonts component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124889 BR2026-0000-046239 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124890 BR2026-0000-046240 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124891 BR2026-0000-046241 unclaimed
High: Incorrect boundary conditions in the DOM: Selection component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124892 BR2026-0000-046242 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124893 BR2026-0000-046243 unclaimed
High: Use-after-free in the DOM: Workers component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124894 BR2026-0000-046244 unclaimed
High: Use-after-free in the Networking: Cookies component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124895 BR2026-0000-046245 unclaimed
High: Use-after-free in the Storage: localStorage & sessionStorage component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124896 BR2026-0000-046246 unclaimed
High: Invalid pointer in the Layout: Text and Fonts component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124897 BR2026-0000-046247 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124898 BR2026-0000-046248 unclaimed
High: Use-after-free in the DOM: Editor component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124899 BR2026-0000-046249 unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-124901 BR2026-0000-046250 unclaimed
High: Other issue in the Networking: JAR component
Credited as dodoh4t
CVE-2026-124902 BR2026-0000-046251 unclaimed
High: Same-origin policy bypass due to race condition in the Audio/Video component
Credited as dodoh4t
CVE-2026-124903 BR2026-0000-046252 unclaimed
High: Sandbox escape due to use-after-free in the IPC component
Credited as Mozilla
CVE-2026-124905 BR2026-0000-046253 unclaimed
High: Sandbox escape in the DOM: Navigation component
Credited as Mozilla
CVE-2026-124906 BR2026-0000-046254 unclaimed
High: Use-after-free in the Graphics: WebRender component
Credited as Mozilla