# ALSA-2026:47101: firefox security update ALSA-2026:47101, released July 28, 2026, fixes 32 CVEs in firefox (version 140.13.0-1.el10_2). None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alsa-2026-47101 - Platform: Linux - Released: Jul 28, 2026 - Priority: Urgent (Closes CVE-2026-16357, rated Critical) - CVEs: 32, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:47101 ## Applies to | Product | Release | Fixed in | |---|---|---| | [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | almalinux 10 | 140.13.0-1.el10_2 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-16357](https://patchblox.com/security/data/cve/CVE-2026-16357.md) | Urgent | Incorrect boundary conditions in the Graphics component | 9.8 | 0.0087 | | | [CVE-2026-16363](https://patchblox.com/security/data/cve/CVE-2026-16363.md) | Urgent | JIT miscompilation in the JavaScript: WebAssembly component | 9.8 | 0.0064 | | | [CVE-2026-16369](https://patchblox.com/security/data/cve/CVE-2026-16369.md) | Urgent | Integer overflow in the JavaScript: WebAssembly component | 9.8 | 0.0064 | | | [CVE-2026-16412](https://patchblox.com/security/data/cve/CVE-2026-16412.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 | 9.8 | 0.0061 | | | [CVE-2026-16350](https://patchblox.com/security/data/cve/CVE-2026-16350.md) | Urgent | Incorrect boundary conditions in the Audio/Video: cubeb component | 9.8 | 0.0060 | | | [CVE-2026-16353](https://patchblox.com/security/data/cve/CVE-2026-16353.md) | Urgent | Invalid pointer in the DOM: Bindings (WebIDL) component | 9.8 | 0.0060 | | | [CVE-2026-16355](https://patchblox.com/security/data/cve/CVE-2026-16355.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0060 | | | [CVE-2026-16351](https://patchblox.com/security/data/cve/CVE-2026-16351.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Navigation component | 9.8 | 0.0058 | | | [CVE-2026-16352](https://patchblox.com/security/data/cve/CVE-2026-16352.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0058 | | | [CVE-2026-16356](https://patchblox.com/security/data/cve/CVE-2026-16356.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0058 | | | [CVE-2026-16361](https://patchblox.com/security/data/cve/CVE-2026-16361.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 | 9.8 | 0.0057 | | | [CVE-2026-16377](https://patchblox.com/security/data/cve/CVE-2026-16377.md) | Urgent | Mitigation bypass in the PDF Viewer component | 9.8 | 0.0057 | | | [CVE-2026-16383](https://patchblox.com/security/data/cve/CVE-2026-16383.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.8 | 0.0057 | | | [CVE-2026-16359](https://patchblox.com/security/data/cve/CVE-2026-16359.md) | Urgent | Incorrect boundary conditions in the Audio/Video: GMP component | 9.1 | 0.0047 | | | [CVE-2026-16360](https://patchblox.com/security/data/cve/CVE-2026-16360.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 | 9.8 | 0.0047 | | | [CVE-2026-16390](https://patchblox.com/security/data/cve/CVE-2026-16390.md) | Urgent | Mitigation bypass in the Enterprise Policies component | 9.1 | 0.0044 | | | [CVE-2026-16368](https://patchblox.com/security/data/cve/CVE-2026-16368.md) | Urgent | Incorrect boundary conditions in the JavaScript: WebAssembly component | 9.8 | 0.0039 | | | [CVE-2026-16358](https://patchblox.com/security/data/cve/CVE-2026-16358.md) | Urgent | Site isolation issue in the Graphics: WebRender component | 9.8 | 0.0030 | | | [CVE-2026-16349](https://patchblox.com/security/data/cve/CVE-2026-16349.md) | Urgent | Same-origin policy bypass in the DOM: Navigation component | 9.8 | 0.0030 | | | [CVE-2026-16375](https://patchblox.com/security/data/cve/CVE-2026-16375.md) | Urgent | Site isolation issue in the Networking: HTTP component | 9.8 | 0.0029 | | | [CVE-2026-16387](https://patchblox.com/security/data/cve/CVE-2026-16387.md) | Urgent | Site isolation issue in the Networking component | 9.8 | 0.0028 | | | [CVE-2026-16381](https://patchblox.com/security/data/cve/CVE-2026-16381.md) | Urgent | Same-origin policy bypass in the Networking: DNS component | 9.1 | 0.0023 | | | [CVE-2026-16354](https://patchblox.com/security/data/cve/CVE-2026-16354.md) | High | Information disclosure in the Graphics: ImageLib component | 8.8 | 0.0047 | | | [CVE-2026-16396](https://patchblox.com/security/data/cve/CVE-2026-16396.md) | High | Privilege escalation in WebExtensions | 8.8 | 0.0045 | | | [CVE-2026-16371](https://patchblox.com/security/data/cve/CVE-2026-16371.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0044 | | | [CVE-2026-16374](https://patchblox.com/security/data/cve/CVE-2026-16374.md) | High | Information disclosure in the Framework component in DevTools | 8.8 | 0.0044 | | | [CVE-2026-16391](https://patchblox.com/security/data/cve/CVE-2026-16391.md) | High | Information disclosure in the Storage: IndexedDB component | 8.8 | 0.0044 | | | [CVE-2026-16405](https://patchblox.com/security/data/cve/CVE-2026-16405.md) | High | Information disclosure in the Networking: WebSockets component | 8.8 | 0.0044 | | | [CVE-2026-16362](https://patchblox.com/security/data/cve/CVE-2026-16362.md) | High | Use-after-free in the WebRTC: Audio/Video component | 8.8 | 0.0044 | | | [CVE-2026-16379](https://patchblox.com/security/data/cve/CVE-2026-16379.md) | High | Privilege escalation in the DOM: Content Processes component | 8.8 | 0.0042 | | | [CVE-2026-15718](https://patchblox.com/security/data/cve/CVE-2026-15718.md) | High | Invalid pointer in the JavaScript: WebAssembly component | 8.8 | 0.0032 | | | [CVE-2026-15719](https://patchblox.com/security/data/cve/CVE-2026-15719.md) | High | Site isolation issue in the DOM: Navigation component | 8.8 | 0.0029 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo