RHSA-2026:99111: Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.Security Fix(es): firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-118007) firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component (CVE-2026-118021) firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-118024) firefox: thunderbird: Race condition, use-after-free in the DOM: File component (CVE-2026-118019) firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124860) firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-124914) firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124869) firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-124854) firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-124877) firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-124917) firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component (CVE-2026-124891) firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-124857) firefox: thunderbird: Information disclosure in the Security: RLBox component (CVE-2026-124941) firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124855) firefox: thunderbird: Spoofing issue in the Security component (CVE-2026-124934) firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component (CVE-2026-124853) firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124905) firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component (CVE-2026-124859) firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124881) firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124862) firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124882) firefox: thunderbird: Information disclosure in the Private Browsing component (CVE-2026-124909) firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124876) firefox: thunderbird: Use-after-free in the DOM: Workers component (CVE-2026-124893) firefox: thunderbird: Use-after-free in the Graphics: WebRender component (CVE-2026-124906) firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124887) firefox: thunderbird: Mitigation bypass in the WebExtensions component (CVE-2026-124910) firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component (CVE-2026-124951) firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124865) firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component (CVE-2026-124948) firefox: thunderbird: Undefined behavior in the WebRTC: Networking component (CVE-2026-124935) firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component (CVE-2026-124875) firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component (CVE-2026-124903) firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component (CVE-2026-124856) firefox: thunderbird: Use-after-free in the Networking: Cookies component (CVE-2026-124894) firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component (CVE-2026-124895) firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-124885) firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-124899) firefox: thunderbird: Sandbox escape in the Console component (CVE-2026-124933) firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-124866) firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124883) firefox: thunderbird: Information disclosure in the Layout: Form Controls component (CVE-2026-124929) firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2026-124870) firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-124927) firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component (CVE-2026-124915) firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124890) firefox: thunderbird: Information disclosure in the Address Bar component (CVE-2026-124930) firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124886) firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124858) firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component (CVE-2026-124907) firefox: thunderbird: Invalid pointer in the DOM: Editor component (CVE-2026-124873) firefox: thunderbird: Spoofing issue in the DOM: Security component (CVE-2026-124912) firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-124874) firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124892) firefox: thunderbird: Invalid pointer in the DOM: Streams component (CVE-2026-124942) firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component (CVE-2026-124922) firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124918) firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124884) firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-124868) firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component (CVE-2026-124919) firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124924) firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component (CVE-2026-124902) firefox: thunderbird: Invalid pointer in the Networking: Cache component (CVE-2026-124879) firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-124932) firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-124940) firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component (CVE-2026-124931) firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-124926) firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124863) firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124889) firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-124913) firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124897) firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component (CVE-2026-124864) firefox: thunderbird: Use-after-free in the Cycle Collector component (CVE-2026-124872) firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124880) firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124896) firefox: thunderbird: Other issue in the Networking: JAR component (CVE-2026-124901) firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124888) firefox: thunderbird: Mitigation bypass in the Add-ons Manager component (CVE-2026-124938) firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component (CVE-2026-124861) firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-124898) firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-124939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat