# CVE-2026-56208: firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Secu... CVE-2026-56208 is fixed in 16 products on 1 platform, first by aom-tools 3.3.0-1ubuntu0.1+esm1, released June 19, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-56208 - Priority: High - CVSS: 8.8 (Important) - EPSS: 0.0045 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 19, 2026 ## Description Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208) * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | SVT-AV1 sles 15.6 | 1.8.0-150600.3.2.5 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | | Linux | SVT-AV1 sles 15.7 | 1.8.0-150600.3.2.5 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | | Linux | aom Debian 12.15 (bookworm) | 3.6.0-1+deb12u3 | [DEBIAN-CVE-2026-56208](https://patchblox.com/security/data/fix/linux/debian-cve-2026-56208.md) | Jun 19, 2026 | | Linux | aom Debian 13.5 (trixie) | 3.12.1-1+deb13u1 | [DEBIAN-CVE-2026-56208](https://patchblox.com/security/data/fix/linux/debian-cve-2026-56208.md) | Jun 19, 2026 | | Linux | aom Debian 14 | 3.14.1-1 | [DEBIAN-CVE-2026-56208](https://patchblox.com/security/data/fix/linux/debian-cve-2026-56208.md) | Jun 19, 2026 | | Linux | aom Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-FD075F5751](https://patchblox.com/security/data/fix/linux/fedora-2026-fd075f5751.md) | Nov 7, 2026 | | Linux | aom-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-FD075F5751](https://patchblox.com/security/data/fix/linux/fedora-2026-fd075f5751.md) | Nov 7, 2026 | | Linux | aom-debugsource Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-FD075F5751](https://patchblox.com/security/data/fix/linux/fedora-2026-fd075f5751.md) | Nov 7, 2026 | | Linux | aom-tools Ubuntu 22.04.1 LTS (jammy) | 3.3.0-1ubuntu0.1+esm1 | [aom-tools 3.3.0-1ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-aom-tools-3.3.0-1ubuntu0.1-esm1.md) | Jun 19, 2026 | | Linux | aom-tools Ubuntu 24.04.5 LTS (noble) | 3.8.2-2ubuntu0.2 | [aom-tools 3.8.2-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-aom-tools-3.8.2-2ubuntu0.2.md) | Jun 19, 2026 | | Linux | aom-tools Ubuntu 26.04.1 LTS (resolute) | 3.13.1-2ubuntu0.1 | [aom-tools 3.13.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-aom-tools-3.13.1-2ubuntu0.1.md) | Jun 19, 2026 | | Linux | firefox RHEL 10 | 140.13.0-1.el10_0 | [RHSA-2026:54181](https://patchblox.com/security/data/fix/linux/rhsa-2026-54181.md) | Jul 31, 2026 | | Linux | firefox RHEL 8 | 0:140.13.0-1.el8_10 | [RHSA-2026:47105](https://patchblox.com/security/data/fix/linux/rhsa-2026-47105.md) | Jul 31, 2026 | | Linux | firefox RHEL 9 | 0:140.13.0-1.el9_8 | [RHSA-2026:47104](https://patchblox.com/security/data/fix/linux/rhsa-2026-47104.md) | Aug 5, 2026 | | Linux | firefox almalinux 8 | 140.13.0-1.el8_10.alma.1 | [ALSA-2026:47105](https://patchblox.com/security/data/fix/linux/alsa-2026-47105.md) | Jul 28, 2026 | | Linux | firefox almalinux 9 | 140.13.0-1.el9_8.alma.1 | [ALSA-2026:47104](https://patchblox.com/security/data/fix/linux/alsa-2026-47104.md) | Jul 28, 2026 | | Linux | firefox amzn 2023 | 140.12.0-1.amzn2023.0.1 | [ALAS2023-2026-1928](https://patchblox.com/security/data/fix/linux/alas2023-2026-1928.md) | Jul 6, 2026 | | Linux | firefox ol 8 | 0:140.13.0-1.0.1.el8_10 | [ELSA-2026-47105](https://patchblox.com/security/data/fix/linux/elsa-2026-47105.md) | Jul 28, 2026 | | Linux | firefox ol 9 | 0:140.13.0-1.0.1.el9_8 | [ELSA-2026-47104](https://patchblox.com/security/data/fix/linux/elsa-2026-47104.md) | Jul 29, 2026 | | Linux | firefox rocky 8 | 0:140.13.0-1.el8_10 | [RLSA-2026:47105](https://patchblox.com/security/data/fix/linux/rlsa-2026-47105.md) | Jul 29, 2026 | | Linux | firefox rocky 9 | 0:140.13.0-1.el9_8 | [RLSA-2026:47104](https://patchblox.com/security/data/fix/linux/rlsa-2026-47104.md) | Aug 3, 2026 | | Linux | firefox-debuginfo amzn 2023 | 140.12.0-1.amzn2023.0.1 | [ALAS2023-2026-1928](https://patchblox.com/security/data/fix/linux/alas2023-2026-1928.md) | Jul 6, 2026 | | Linux | firefox-debugsource amzn 2023 | 140.12.0-1.amzn2023.0.1 | [ALAS2023-2026-1928](https://patchblox.com/security/data/fix/linux/alas2023-2026-1928.md) | Jul 6, 2026 | | Linux | firefox-x11 RHEL 9 | 0:140.13.0-1.el9_8 | [RHSA-2026:47104](https://patchblox.com/security/data/fix/linux/rhsa-2026-47104.md) | Aug 5, 2026 | | Linux | firefox-x11 almalinux 9 | 140.13.0-1.el9_8.alma.1 | [ALSA-2026:47104](https://patchblox.com/security/data/fix/linux/alsa-2026-47104.md) | Jul 28, 2026 | | Linux | firefox-x11 ol 9 | 0:140.13.0-1.0.1.el9_8 | [ELSA-2026-47104](https://patchblox.com/security/data/fix/linux/elsa-2026-47104.md) | Jul 29, 2026 | | Linux | libaom Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-FD075F5751](https://patchblox.com/security/data/fix/linux/fedora-2026-fd075f5751.md) | Nov 7, 2026 | | Linux | libaom opensuse-leap 16.0 | 3.11.0-160000.3.1 | [OPENSUSE-SU-2026:21061-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21061-1.md) | Jun 25, 2026 | | Linux | libaom sles 15.6 | 3.7.1-150600.3.9.1 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | | Linux | libaom sles 15.7 | 3.7.1-150600.3.9.1 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | | Linux | libaom sles 16.0 | 3.11.0-160000.3.1 | [SUSE-SU-2026:22369-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22369-1.md) | Jun 25, 2026 | | Linux | libaom-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-FD075F5751](https://patchblox.com/security/data/fix/linux/fedora-2026-fd075f5751.md) | Nov 7, 2026 | | Linux | libaom-devel Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-FD075F5751](https://patchblox.com/security/data/fix/linux/fedora-2026-fd075f5751.md) | Nov 7, 2026 | | Linux | libaom-devel-doc opensuse-leap 16.0 | 3.11.0-160000.3.1 | [OPENSUSE-SU-2026:21061-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21061-1.md) | Jun 25, 2026 | | Linux | libaom-devel-doc sles 15.6 | 3.7.1-150600.3.9.3 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | | Linux | libaom-devel-doc sles 15.7 | 3.7.1-150600.3.9.3 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | | Linux | libaom-devel-docs Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-FD075F5751](https://patchblox.com/security/data/fix/linux/fedora-2026-fd075f5751.md) | Nov 7, 2026 | | Linux | libaom3 Ubuntu 22.04.1 LTS (jammy) | 3.3.0-1ubuntu0.1+esm1 | [libaom3 3.3.0-1ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libaom3-3.3.0-1ubuntu0.1-esm1.md) | Jun 19, 2026 | | Linux | libaom3 Ubuntu 24.04.5 LTS (noble) | 3.8.2-2ubuntu0.2 | [libaom3 3.8.2-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libaom3-3.8.2-2ubuntu0.2.md) | Jun 19, 2026 | | Linux | libaom3 Ubuntu 26.04.1 LTS (resolute) | 3.13.1-2ubuntu0.1 | [libaom3 3.13.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libaom3-3.13.1-2ubuntu0.1.md) | Jun 19, 2026 | | Linux | libyuv sles 15.6 | 20230517+a377993-150600.3.4.2 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | | Linux | libyuv sles 15.7 | 20230517+a377993-150600.3.4.2 | [SUSE-SU-2026:3224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3224-1.md) | Jul 23, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.