# ELSA-2026-89757: Security update for 2 packages ELSA-2026-89757, released November 7, 2026, fixes 48 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/elsa-2026-89757 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-109745, rated Critical) - CVEs: 48, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-89757.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | ol 9 | 0:153.5.0-1.0.1.el9_8 | | [firefox-x11](https://patchblox.com/security/data/product/linux/firefox-x11.md) | ol 9 | 0:153.5.0-1.0.1.el9_8 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-109745](https://patchblox.com/security/data/cve/CVE-2026-109745.md) | Urgent | firefox-esr: Sandbox escape due to uninitialized memory in the DOM: Web Serial component | 9.6 | 0.0035 | | | [CVE-2026-109708](https://patchblox.com/security/data/cve/CVE-2026-109708.md) | Urgent | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Networking component | 9.6 | 0.0033 | | | [CVE-2026-109705](https://patchblox.com/security/data/cve/CVE-2026-109705.md) | Urgent | thunderbird: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component | 9.6 | 0.0033 | | | [CVE-2026-109707](https://patchblox.com/security/data/cve/CVE-2026-109707.md) | Urgent | firefox-esr: Sandbox escape due to use-after-free in the Networking component | 9.6 | 0.0033 | | | [CVE-2026-45186](https://patchblox.com/security/data/cve/CVE-2026-45186.md) | High | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | 8.2 | 0.0048 | | | [CVE-2026-109733](https://patchblox.com/security/data/cve/CVE-2026-109733.md) | High | thunderbird: JIT miscompilation in the JavaScript Engine: JIT component | 8.8 | 0.0046 | | | [CVE-2026-109704](https://patchblox.com/security/data/cve/CVE-2026-109704.md) | High | firefox: Privilege escalation in the Application Update component | 8.2 | 0.0041 | | | [CVE-2026-109730](https://patchblox.com/security/data/cve/CVE-2026-109730.md) | High | thunderbird: Integer overflow in the Graphics component | 8.8 | 0.0037 | | | [CVE-2026-109743](https://patchblox.com/security/data/cve/CVE-2026-109743.md) | High | thunderbird: Privilege escalation in the Panning and Zooming component | 8.8 | 0.0035 | | | [CVE-2026-109762](https://patchblox.com/security/data/cve/CVE-2026-109762.md) | High | firefox-esr: Incorrect boundary conditions in the SVG component | 8.8 | 0.0035 | | | [CVE-2026-109740](https://patchblox.com/security/data/cve/CVE-2026-109740.md) | High | firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Secu... | 8.2 | 0.0035 | | | [CVE-2026-109753](https://patchblox.com/security/data/cve/CVE-2026-109753.md) | High | thunderbird: Incorrect boundary conditions in the Layout component | 8.1 | 0.0034 | | | [CVE-2026-109737](https://patchblox.com/security/data/cve/CVE-2026-109737.md) | High | firefox-esr: Mitigation bypass in the Enterprise Policies component | 8.1 | 0.0034 | | | [CVE-2026-109760](https://patchblox.com/security/data/cve/CVE-2026-109760.md) | High | firefox-esr: Mitigation bypass in the Networking: HTTP component | 8.1 | 0.0034 | | | [CVE-2026-109709](https://patchblox.com/security/data/cve/CVE-2026-109709.md) | High | thunderbird: Information disclosure, privilege escalation in the Security: Process Sandboxing component | 8.8 | 0.0033 | | | [CVE-2026-109736](https://patchblox.com/security/data/cve/CVE-2026-109736.md) | High | firefox-esr: Frame poisoning in the Layout component | 8.1 | 0.0032 | | | [CVE-2026-109744](https://patchblox.com/security/data/cve/CVE-2026-109744.md) | High | firefox-esr: Other issue in the DOM: File component | 8.1 | 0.0032 | | | [CVE-2026-109754](https://patchblox.com/security/data/cve/CVE-2026-109754.md) | High | firefox-esr: Incorrect boundary conditions in the DOM: Editor component | 8.1 | 0.0032 | | | [CVE-2026-109756](https://patchblox.com/security/data/cve/CVE-2026-109756.md) | High | thunderbird: Privilege escalation in the DOM: Navigation component | 8.8 | 0.0032 | | | [CVE-2026-109715](https://patchblox.com/security/data/cve/CVE-2026-109715.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine component | 8.8 | 0.0031 | | | [CVE-2026-109716](https://patchblox.com/security/data/cve/CVE-2026-109716.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine component | 8.8 | 0.0031 | | | [CVE-2026-109722](https://patchblox.com/security/data/cve/CVE-2026-109722.md) | High | firefox-esr: JIT miscompilation in the JavaScript Engine: JIT component | 8.8 | 0.0031 | | | [CVE-2026-109721](https://patchblox.com/security/data/cve/CVE-2026-109721.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine: JIT component | 8.8 | 0.0028 | | | [CVE-2026-109782](https://patchblox.com/security/data/cve/CVE-2026-109782.md) | High | firefox-esr: Mitigation bypass in the File Handling component | 8.3 | 0.0027 | | | [CVE-2026-109720](https://patchblox.com/security/data/cve/CVE-2026-109720.md) | High | firefox-esr: JIT miscompilation in the JavaScript: WebAssembly component | 8.8 | 0.0026 | | | [CVE-2026-109742](https://patchblox.com/security/data/cve/CVE-2026-109742.md) | High | thunderbird: Information disclosure in the PDF Viewer component | 7.5 | 0.0026 | | | [CVE-2026-109751](https://patchblox.com/security/data/cve/CVE-2026-109751.md) | High | thunderbird: Information disclosure in the Networking component | 7.5 | 0.0026 | | | [CVE-2026-109757](https://patchblox.com/security/data/cve/CVE-2026-109757.md) | High | thunderbird: Sandbox escape due to race condition in the Networking component | 8.3 | 0.0026 | | | [CVE-2026-109763](https://patchblox.com/security/data/cve/CVE-2026-109763.md) | High | thunderbird: Mitigation bypass in the File Handling component | 7.5 | 0.0025 | | | [CVE-2026-109729](https://patchblox.com/security/data/cve/CVE-2026-109729.md) | High | thunderbird: Use-after-free in the JavaScript Engine: JIT component | 8.2 | 0.0024 | | | [CVE-2026-109732](https://patchblox.com/security/data/cve/CVE-2026-109732.md) | High | thunderbird: Use-after-free in the DOM: Streams component | 8.2 | 0.0024 | | | [CVE-2026-109752](https://patchblox.com/security/data/cve/CVE-2026-109752.md) | High | thunderbird: Use-after-free in the DOM: Workers component | 8.8 | 0.0023 | | | [CVE-2026-109738](https://patchblox.com/security/data/cve/CVE-2026-109738.md) | High | thunderbird: Use-after-free in the Audio/Video: Playback component | 7.5 | 0.0023 | | | [CVE-2026-109741](https://patchblox.com/security/data/cve/CVE-2026-109741.md) | High | thunderbird: Use-after-free in the Storage: Bucket File System component | 7.5 | 0.0023 | | | [CVE-2026-109718](https://patchblox.com/security/data/cve/CVE-2026-109718.md) | High | thunderbird: Use-after-free in the XML component | 8.8 | 0.0023 | | | [CVE-2026-109725](https://patchblox.com/security/data/cve/CVE-2026-109725.md) | High | thunderbird: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0023 | | | [CVE-2026-109728](https://patchblox.com/security/data/cve/CVE-2026-109728.md) | High | thunderbird: Use-after-free in the DOM: Animation component | 8.8 | 0.0023 | | | [CVE-2026-109706](https://patchblox.com/security/data/cve/CVE-2026-109706.md) | High | thunderbird: Use-after-free in the Storage: IndexedDB component | 8.2 | 0.0023 | | | [CVE-2026-109726](https://patchblox.com/security/data/cve/CVE-2026-109726.md) | High | thunderbird: Use-after-free in the SVG component | 8.2 | 0.0023 | | | [CVE-2026-109727](https://patchblox.com/security/data/cve/CVE-2026-109727.md) | High | thunderbird: Use-after-free in the Audio/Video component | 8.2 | 0.0023 | | | [CVE-2026-109712](https://patchblox.com/security/data/cve/CVE-2026-109712.md) | High | firefox-esr: Sandbox escape due to uninitialized memory in the Graphics component | 8.8 | 0.0022 | | | [CVE-2026-109711](https://patchblox.com/security/data/cve/CVE-2026-109711.md) | High | thunderbird: Use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0022 | | | [CVE-2026-109713](https://patchblox.com/security/data/cve/CVE-2026-109713.md) | High | thunderbird: Use-after-free in the Crash Reporting component | 8.8 | 0.0022 | | | [CVE-2026-109723](https://patchblox.com/security/data/cve/CVE-2026-109723.md) | High | thunderbird: Integer overflow in the Layout: Text and Fonts component | 8.8 | 0.0022 | | | [CVE-2026-109724](https://patchblox.com/security/data/cve/CVE-2026-109724.md) | High | thunderbird: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0022 | | | [CVE-2026-109717](https://patchblox.com/security/data/cve/CVE-2026-109717.md) | High | thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component | 8.2 | 0.0022 | | | [CVE-2026-109759](https://patchblox.com/security/data/cve/CVE-2026-109759.md) | High | firefox-esr: Site isolation issue in the Networking component | 8.1 | 0.0018 | | | [CVE-2026-109719](https://patchblox.com/security/data/cve/CVE-2026-109719.md) | High | thunderbird: Race condition, use-after-free in the Graphics: CanvasWebGL component | 8.2 | 0.0017 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo