# ELSA-2026-94405: firefox security update

ELSA-2026-94405, released November 7, 2026, fixes 144 CVEs in firefox (version 0:153.6.0-1.0.1.el8_10). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/elsa-2026-94405
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-117946, rated Critical)
- CVEs: 144, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-94405.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | ol 8 | 0:153.6.0-1.0.1.el8_10 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-117862](https://patchblox.com/security/data/cve/CVE-2026-117862.md) | Urgent | firefox-esr: Privilege escalation due to incorrect boundary conditions in the Networking component | 9.8 | 0.0053 |  |
| [CVE-2026-117917](https://patchblox.com/security/data/cve/CVE-2026-117917.md) | Urgent | firefox-esr: Invalid pointer in the Graphics: WebRender component | 9.8 | 0.0053 |  |
| [CVE-2026-117946](https://patchblox.com/security/data/cve/CVE-2026-117946.md) | Urgent | firefox-esr: Incorrect boundary conditions in the JavaScript Engine component | 9.8 | 0.0053 |  |
| [CVE-2026-117945](https://patchblox.com/security/data/cve/CVE-2026-117945.md) | Urgent | firefox-esr: Incorrect boundary conditions in the XML component | 9.8 | 0.0051 |  |
| [CVE-2026-117982](https://patchblox.com/security/data/cve/CVE-2026-117982.md) | Urgent | firefox-esr: Invalid pointer in the JavaScript Engine: JIT component | 9.8 | 0.0051 |  |
| [CVE-2026-117980](https://patchblox.com/security/data/cve/CVE-2026-117980.md) | Urgent | firefox-esr: Use-after-free in the Graphics component | 9.8 | 0.0049 |  |
| [CVE-2026-117981](https://patchblox.com/security/data/cve/CVE-2026-117981.md) | Urgent | firefox-esr: Privilege escalation in the Toolkit component | 9.8 | 0.0047 |  |
| [CVE-2026-117868](https://patchblox.com/security/data/cve/CVE-2026-117868.md) | Urgent | firefox-esr: Sandbox escape in the DOM: Networking component | 9.6 | 0.0041 |  |
| [CVE-2026-117971](https://patchblox.com/security/data/cve/CVE-2026-117971.md) | Urgent | firefox-esr: Sandbox escape due to use-after-free in the Print Preview component | 9.6 | 0.0040 |  |
| [CVE-2026-117861](https://patchblox.com/security/data/cve/CVE-2026-117861.md) | Urgent | firefox-esr: Sandbox escape in the DOM: Navigation component | 9.6 | 0.0039 |  |
| [CVE-2026-117962](https://patchblox.com/security/data/cve/CVE-2026-117962.md) | Urgent | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component | 9.6 | 0.0039 |  |
| [CVE-2026-117988](https://patchblox.com/security/data/cve/CVE-2026-117988.md) | Urgent | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 9.6 | 0.0039 |  |
| [CVE-2026-117990](https://patchblox.com/security/data/cve/CVE-2026-117990.md) | Urgent | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | 9.6 | 0.0039 |  |
| [CVE-2026-117920](https://patchblox.com/security/data/cve/CVE-2026-117920.md) | Urgent | firefox-esr: Use-after-free in the DOM: HTML Parser component | 9.6 | 0.0038 |  |
| [CVE-2026-117985](https://patchblox.com/security/data/cve/CVE-2026-117985.md) | Urgent | firefox-esr: Sandbox escape due to use-after-free in the Graphics component | 9.6 | 0.0038 |  |
| [CVE-2026-117997](https://patchblox.com/security/data/cve/CVE-2026-117997.md) | Urgent | firefox-esr: Sandbox escape due to use-after-free in the Widget component | 9.6 | 0.0038 |  |
| [CVE-2026-117925](https://patchblox.com/security/data/cve/CVE-2026-117925.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0043 |  |
| [CVE-2026-117967](https://patchblox.com/security/data/cve/CVE-2026-117967.md) | High | firefox-esr: Mitigation bypass in the DOM: Security component | 8.8 | 0.0041 |  |
| [CVE-2026-117998](https://patchblox.com/security/data/cve/CVE-2026-117998.md) | High | firefox-esr: Mitigation bypass in the DOM: Push Subscriptions component | 8.8 | 0.0041 |  |
| [CVE-2026-117950](https://patchblox.com/security/data/cve/CVE-2026-117950.md) | High | firefox-esr: Incorrect boundary conditions in the DOM: Core & HTML component | 8.8 | 0.0041 |  |
| [CVE-2026-117979](https://patchblox.com/security/data/cve/CVE-2026-117979.md) | High | firefox-esr: Incorrect boundary conditions in the Graphics: WebRender component | 8.8 | 0.0041 |  |
| [CVE-2026-117869](https://patchblox.com/security/data/cve/CVE-2026-117869.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117872](https://patchblox.com/security/data/cve/CVE-2026-117872.md) | High | firefox-esr: Use-after-free in the JavaScript: Standard Library component | 8.8 | 0.0040 |  |
| [CVE-2026-117881](https://patchblox.com/security/data/cve/CVE-2026-117881.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117883](https://patchblox.com/security/data/cve/CVE-2026-117883.md) | High | firefox-esr: Use-after-free in the DOM: HTML Parser component | 8.8 | 0.0040 |  |
| [CVE-2026-117884](https://patchblox.com/security/data/cve/CVE-2026-117884.md) | High | firefox-esr: Use-after-free in the Networking component | 8.8 | 0.0040 |  |
| [CVE-2026-117887](https://patchblox.com/security/data/cve/CVE-2026-117887.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117899](https://patchblox.com/security/data/cve/CVE-2026-117899.md) | High | firefox-esr: Use-after-free in the Networking: HTTP component | 8.8 | 0.0040 |  |
| [CVE-2026-117900](https://patchblox.com/security/data/cve/CVE-2026-117900.md) | High | firefox-esr: Use-after-free in the DOM: Editor component | 8.8 | 0.0040 |  |
| [CVE-2026-117901](https://patchblox.com/security/data/cve/CVE-2026-117901.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117918](https://patchblox.com/security/data/cve/CVE-2026-117918.md) | High | firefox-esr: Use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0040 |  |
| [CVE-2026-117919](https://patchblox.com/security/data/cve/CVE-2026-117919.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117921](https://patchblox.com/security/data/cve/CVE-2026-117921.md) | High | firefox-esr: Use-after-free in the CSS Parsing and Computation component | 8.8 | 0.0040 |  |
| [CVE-2026-117922](https://patchblox.com/security/data/cve/CVE-2026-117922.md) | High | firefox-esr: Use-after-free in the Networking: WebSockets component | 8.8 | 0.0040 |  |
| [CVE-2026-117929](https://patchblox.com/security/data/cve/CVE-2026-117929.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117930](https://patchblox.com/security/data/cve/CVE-2026-117930.md) | High | firefox-esr: Use-after-free in the DOM: Bindings (WebIDL) component | 8.8 | 0.0040 |  |
| [CVE-2026-117931](https://patchblox.com/security/data/cve/CVE-2026-117931.md) | High | thunderbird: Use-after-free in the DOM: Events component | 8.8 | 0.0040 |  |
| [CVE-2026-117936](https://patchblox.com/security/data/cve/CVE-2026-117936.md) | High | thunderbird: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117941](https://patchblox.com/security/data/cve/CVE-2026-117941.md) | High | firefox-esr: Use-after-free in the DOM: CSS Object Model component | 8.8 | 0.0040 |  |
| [CVE-2026-117943](https://patchblox.com/security/data/cve/CVE-2026-117943.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117949](https://patchblox.com/security/data/cve/CVE-2026-117949.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117951](https://patchblox.com/security/data/cve/CVE-2026-117951.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117954](https://patchblox.com/security/data/cve/CVE-2026-117954.md) | High | firefox-esr: Use-after-free in the Layout: Positioned component | 8.8 | 0.0040 |  |
| [CVE-2026-117968](https://patchblox.com/security/data/cve/CVE-2026-117968.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 |  |
| [CVE-2026-117974](https://patchblox.com/security/data/cve/CVE-2026-117974.md) | High | firefox-esr: Use-after-free in the XML component | 8.8 | 0.0040 |  |
| [CVE-2026-117864](https://patchblox.com/security/data/cve/CVE-2026-117864.md) | High | firefox-esr: Sandbox escape in the Form Manager component | 8.8 | 0.0039 |  |
| [CVE-2026-117956](https://patchblox.com/security/data/cve/CVE-2026-117956.md) | High | firefox-esr: Invalid pointer in the Nimbus Desktop Client component | 8.8 | 0.0039 |  |
| [CVE-2026-117969](https://patchblox.com/security/data/cve/CVE-2026-117969.md) | High | firefox-esr: Invalid pointer in the JavaScript Engine: JIT component | 8.8 | 0.0039 |  |
| [CVE-2026-117975](https://patchblox.com/security/data/cve/CVE-2026-117975.md) | High | firefox-esr: Sandbox escape due to invalid pointer in the Graphics: WebRender component | 8.8 | 0.0039 |  |
| [CVE-2026-117984](https://patchblox.com/security/data/cve/CVE-2026-117984.md) | High | firefox-esr: Incorrect boundary conditions in the Layout: Scrolling and Overflow component | 8.8 | 0.0039 |  |
| [CVE-2026-117991](https://patchblox.com/security/data/cve/CVE-2026-117991.md) | High | firefox-esr: Incorrect boundary conditions in the Layout: Text and Fonts component | 8.8 | 0.0039 |  |
| [CVE-2026-117993](https://patchblox.com/security/data/cve/CVE-2026-117993.md) | High | firefox-esr: Integer overflow in the Graphics: Text component | 8.8 | 0.0039 |  |
| [CVE-2026-117926](https://patchblox.com/security/data/cve/CVE-2026-117926.md) | High | firefox-esr: Incorrect boundary conditions in the SVG component | 8.8 | 0.0038 |  |
| [CVE-2026-117978](https://patchblox.com/security/data/cve/CVE-2026-117978.md) | High | thunderbird: Incorrect boundary conditions in the Graphics component | 8.8 | 0.0038 |  |
| [CVE-2026-117873](https://patchblox.com/security/data/cve/CVE-2026-117873.md) | High | firefox-esr: Incorrect boundary conditions in the Audio/Video: Playback component | 8.1 | 0.0038 |  |
| [CVE-2026-117886](https://patchblox.com/security/data/cve/CVE-2026-117886.md) | High | firefox-esr: Incorrect boundary conditions in the Graphics: Text component | 8.1 | 0.0038 |  |
| [CVE-2026-117952](https://patchblox.com/security/data/cve/CVE-2026-117952.md) | High | firefox-esr: Uninitialized memory in the Networking component | 8.1 | 0.0038 |  |
| [CVE-2026-117904](https://patchblox.com/security/data/cve/CVE-2026-117904.md) | High | firefox-esr: Use-after-free in the JavaScript: GC component | 8.8 | 0.0038 |  |
| [CVE-2026-117932](https://patchblox.com/security/data/cve/CVE-2026-117932.md) | High | thunderbird: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0038 |  |
| [CVE-2026-117940](https://patchblox.com/security/data/cve/CVE-2026-117940.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0038 |  |
| [CVE-2026-117953](https://patchblox.com/security/data/cve/CVE-2026-117953.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0038 |  |
| [CVE-2026-117964](https://patchblox.com/security/data/cve/CVE-2026-117964.md) | High | firefox-esr: Use-after-free in the Panning and Zooming component | 8.8 | 0.0038 |  |
| [CVE-2026-117972](https://patchblox.com/security/data/cve/CVE-2026-117972.md) | High | firefox-esr: Use-after-free in the Graphics component | 8.8 | 0.0038 |  |
| [CVE-2026-117973](https://patchblox.com/security/data/cve/CVE-2026-117973.md) | High | firefox-esr: Use-after-free in the Networking: DNS component | 8.8 | 0.0038 |  |
| [CVE-2026-117983](https://patchblox.com/security/data/cve/CVE-2026-117983.md) | High | firefox-esr: Use-after-free in the Graphics component | 8.8 | 0.0038 |  |
| [CVE-2026-117986](https://patchblox.com/security/data/cve/CVE-2026-117986.md) | High | firefox-esr: Use-after-free in the Graphics component | 8.8 | 0.0038 |  |
| [CVE-2026-117987](https://patchblox.com/security/data/cve/CVE-2026-117987.md) | High | firefox-esr: Use-after-free in the Graphics component | 8.8 | 0.0038 |  |
| [CVE-2026-117989](https://patchblox.com/security/data/cve/CVE-2026-117989.md) | High | firefox-esr: Use-after-free in the Graphics component | 8.8 | 0.0038 |  |
| [CVE-2026-117994](https://patchblox.com/security/data/cve/CVE-2026-117994.md) | High | thunderbird: Use-after-free in the JavaScript: GC component | 8.8 | 0.0038 |  |
| [CVE-2026-118000](https://patchblox.com/security/data/cve/CVE-2026-118000.md) | High | firefox-esr: Information disclosure in the Networking: HTTP component | 8.1 | 0.0037 |  |
| [CVE-2026-118002](https://patchblox.com/security/data/cve/CVE-2026-118002.md) | High | firefox-esr: Information disclosure due to race condition in the Networking component | 8.1 | 0.0037 |  |
| [CVE-2026-118003](https://patchblox.com/security/data/cve/CVE-2026-118003.md) | High | firefox-esr: Information disclosure in the Networking: DNS component | 8.1 | 0.0037 |  |
| [CVE-2026-117955](https://patchblox.com/security/data/cve/CVE-2026-117955.md) | High | firefox-esr: JIT miscompilation in the JavaScript: WebAssembly component | 8.8 | 0.0036 |  |
| [CVE-2026-117995](https://patchblox.com/security/data/cve/CVE-2026-117995.md) | High | firefox-esr: Privilege escalation in the DOM: UI Events & Focus Handling component | 8.8 | 0.0036 |  |
| [CVE-2026-117961](https://patchblox.com/security/data/cve/CVE-2026-117961.md) | High | firefox-esr: Incorrect boundary conditions in the Layout: Text and Fonts component | 8.1 | 0.0036 |  |
| [CVE-2026-117963](https://patchblox.com/security/data/cve/CVE-2026-117963.md) | High | firefox-esr: Incorrect boundary conditions in the DOM: Service Workers component | 8.1 | 0.0036 |  |
| [CVE-2026-117977](https://patchblox.com/security/data/cve/CVE-2026-117977.md) | High | thunderbird: Other issue in the Console component | 8.1 | 0.0036 |  |
| [CVE-2026-117996](https://patchblox.com/security/data/cve/CVE-2026-117996.md) | High | firefox-esr: Incorrect boundary conditions in the WebRTC component | 8.1 | 0.0036 |  |
| [CVE-2026-118004](https://patchblox.com/security/data/cve/CVE-2026-118004.md) | High | firefox-esr: Incorrect boundary conditions in the CSS Transitions and Animations component | 8.1 | 0.0036 |  |
| [CVE-2026-117867](https://patchblox.com/security/data/cve/CVE-2026-117867.md) | High | firefox-esr: Use-after-free in the Layout component | 8.8 | 0.0036 |  |
| [CVE-2026-117870](https://patchblox.com/security/data/cve/CVE-2026-117870.md) | High | firefox-esr: Use-after-free in the JavaScript Engine component | 8.8 | 0.0036 |  |
| [CVE-2026-117879](https://patchblox.com/security/data/cve/CVE-2026-117879.md) | High | firefox-esr: Incorrect boundary conditions in the Layout: Tables component | 8.8 | 0.0036 |  |
| [CVE-2026-117889](https://patchblox.com/security/data/cve/CVE-2026-117889.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine component | 8.8 | 0.0036 |  |
| [CVE-2026-117897](https://patchblox.com/security/data/cve/CVE-2026-117897.md) | High | firefox-esr: Incorrect boundary conditions in the Layout: Tables component | 8.8 | 0.0036 |  |
| [CVE-2026-117915](https://patchblox.com/security/data/cve/CVE-2026-117915.md) | High | firefox-esr: Incorrect boundary conditions in the Layout: Block and Inline component | 8.8 | 0.0036 |  |
| [CVE-2026-117937](https://patchblox.com/security/data/cve/CVE-2026-117937.md) | High | thunderbird: Invalid pointer in the JavaScript Engine component | 8.8 | 0.0036 |  |
| [CVE-2026-117942](https://patchblox.com/security/data/cve/CVE-2026-117942.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine: JIT component | 8.8 | 0.0036 |  |
| [CVE-2026-117866](https://patchblox.com/security/data/cve/CVE-2026-117866.md) | High | firefox-esr: Privilege escalation due to use-after-free in the Graphics: Canvas2D component | 7.5 | 0.0036 |  |
| [CVE-2026-117891](https://patchblox.com/security/data/cve/CVE-2026-117891.md) | High | firefox-esr: Use-after-free in the JavaScript Engine: JIT component | 7.5 | 0.0036 |  |
| [CVE-2026-117892](https://patchblox.com/security/data/cve/CVE-2026-117892.md) | High | firefox-esr: Privilege escalation due to use-after-free in the WebRTC: Networking component | 7.5 | 0.0036 |  |
| [CVE-2026-117959](https://patchblox.com/security/data/cve/CVE-2026-117959.md) | High | firefox-esr: Site isolation issue in the DOM: Service Workers component | 8.4 | 0.0034 |  |
| [CVE-2026-117871](https://patchblox.com/security/data/cve/CVE-2026-117871.md) | High | firefox-esr: Invalid pointer in the Graphics component | 8.8 | 0.0034 |  |
| [CVE-2026-117910](https://patchblox.com/security/data/cve/CVE-2026-117910.md) | High | firefox-esr: Invalid pointer in the JavaScript Engine component | 8.8 | 0.0034 |  |
| [CVE-2026-117890](https://patchblox.com/security/data/cve/CVE-2026-117890.md) | High | firefox-esr: JIT miscompilation in the JavaScript Engine: JIT component | 7.3 | 0.0034 |  |
| [CVE-2026-117903](https://patchblox.com/security/data/cve/CVE-2026-117903.md) | High | firefox-esr: Use-after-free in the Audio/Video component | 8.8 | 0.0031 |  |
| [CVE-2026-117970](https://patchblox.com/security/data/cve/CVE-2026-117970.md) | High | firefox-esr: Race condition in the Disability Access APIs component | 8.8 | 0.0030 |  |
| [CVE-2026-117999](https://patchblox.com/security/data/cve/CVE-2026-117999.md) | High | firefox-esr: Race condition in the IPC component | 8.8 | 0.0030 |  |
| [CVE-2026-117895](https://patchblox.com/security/data/cve/CVE-2026-117895.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0027 |  |
| [CVE-2026-117905](https://patchblox.com/security/data/cve/CVE-2026-117905.md) | High | firefox-esr: Use-after-free in the Audio/Video: Playback component | 8.8 | 0.0027 |  |
| [CVE-2026-117908](https://patchblox.com/security/data/cve/CVE-2026-117908.md) | High | firefox-esr: Use-after-free in the Graphics: ImageLib component | 8.8 | 0.0027 |  |
| [CVE-2026-117911](https://patchblox.com/security/data/cve/CVE-2026-117911.md) | High | firefox-esr: Use-after-free in the Audio/Video: Playback component | 8.8 | 0.0027 |  |
| [CVE-2026-117914](https://patchblox.com/security/data/cve/CVE-2026-117914.md) | High | firefox-esr: Use-after-free in the SVG component | 8.8 | 0.0027 |  |
| [CVE-2026-117923](https://patchblox.com/security/data/cve/CVE-2026-117923.md) | High | firefox-esr: Use-after-free in the Audio/Video component | 8.8 | 0.0027 |  |
| [CVE-2026-117924](https://patchblox.com/security/data/cve/CVE-2026-117924.md) | High | firefox-esr: Use-after-free in the XSLT component | 8.8 | 0.0027 |  |
| [CVE-2026-117934](https://patchblox.com/security/data/cve/CVE-2026-117934.md) | High | thunderbird: Use-after-free in the Layout component | 8.8 | 0.0027 |  |
| [CVE-2026-117938](https://patchblox.com/security/data/cve/CVE-2026-117938.md) | High | thunderbird: Use-after-free in the Layout component | 8.8 | 0.0027 |  |
| [CVE-2026-117939](https://patchblox.com/security/data/cve/CVE-2026-117939.md) | High | firefox-esr: Use-after-free in the XML component | 8.8 | 0.0027 |  |
| [CVE-2026-117944](https://patchblox.com/security/data/cve/CVE-2026-117944.md) | High | firefox-esr: Use-after-free in the Layout component | 8.8 | 0.0027 |  |
| [CVE-2026-117948](https://patchblox.com/security/data/cve/CVE-2026-117948.md) | High | firefox-esr: Use-after-free in the SVG component | 8.8 | 0.0027 |  |
| [CVE-2026-117874](https://patchblox.com/security/data/cve/CVE-2026-117874.md) | High | firefox-esr: Use-after-free in the Internationalization component | 7.5 | 0.0027 |  |
| [CVE-2026-117876](https://patchblox.com/security/data/cve/CVE-2026-117876.md) | High | firefox-esr: Use-after-free in the Layout: Text and Fonts component | 7.5 | 0.0027 |  |
| [CVE-2026-117878](https://patchblox.com/security/data/cve/CVE-2026-117878.md) | High | firefox-esr: Other issue, use-after-free in the Storage: IndexedDB component | 7.5 | 0.0027 |  |
| [CVE-2026-117880](https://patchblox.com/security/data/cve/CVE-2026-117880.md) | High | firefox-esr: Use-after-free in the XML component | 7.5 | 0.0027 |  |
| [CVE-2026-117882](https://patchblox.com/security/data/cve/CVE-2026-117882.md) | High | firefox-esr: Use-after-free in the Layout component | 7.5 | 0.0027 |  |
| [CVE-2026-117896](https://patchblox.com/security/data/cve/CVE-2026-117896.md) | High | firefox-esr: Use-after-free in the DOM: Core & HTML component | 7.5 | 0.0027 |  |
| [CVE-2026-117906](https://patchblox.com/security/data/cve/CVE-2026-117906.md) | High | firefox-esr: Use-after-free in the CSS Parsing and Computation component | 7.5 | 0.0027 |  |
| [CVE-2026-117927](https://patchblox.com/security/data/cve/CVE-2026-117927.md) | High | firefox-esr: Use-after-free in the SVG component | 7.5 | 0.0027 |  |
| [CVE-2026-117935](https://patchblox.com/security/data/cve/CVE-2026-117935.md) | High | thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component | 7.5 | 0.0027 |  |
| [CVE-2026-117907](https://patchblox.com/security/data/cve/CVE-2026-117907.md) | High | thunderbird: Use-after-free in the Networking component | 7.0 | 0.0027 |  |
| [CVE-2026-117894](https://patchblox.com/security/data/cve/CVE-2026-117894.md) | High | firefox-esr: Incorrect boundary conditions in the WebRTC: Signaling component | 8.8 | 0.0027 |  |
| [CVE-2026-117888](https://patchblox.com/security/data/cve/CVE-2026-117888.md) | High | firefox-esr: Uninitialized memory in the Graphics: Canvas2D component | 7.4 | 0.0027 |  |
| [CVE-2026-117909](https://patchblox.com/security/data/cve/CVE-2026-117909.md) | High | firefox-esr: Use-after-free in the JavaScript: GC component | 8.8 | 0.0026 |  |
| [CVE-2026-117947](https://patchblox.com/security/data/cve/CVE-2026-117947.md) | High | firefox-esr: Use-after-free in the XML component | 8.8 | 0.0026 |  |
| [CVE-2026-117865](https://patchblox.com/security/data/cve/CVE-2026-117865.md) | High | thunderbird: Use-after-free in the JavaScript: GC component | 7.5 | 0.0026 |  |
| [CVE-2026-117875](https://patchblox.com/security/data/cve/CVE-2026-117875.md) | High | firefox-esr: Use-after-free in the Layout: Scrolling and Overflow component | 7.5 | 0.0026 |  |
| [CVE-2026-117877](https://patchblox.com/security/data/cve/CVE-2026-117877.md) | High | firefox-esr: Use-after-free in the Layout: Text and Fonts component | 7.5 | 0.0026 |  |
| [CVE-2026-117898](https://patchblox.com/security/data/cve/CVE-2026-117898.md) | High | firefox-esr: Use-after-free in the JavaScript Engine: JIT component | 7.5 | 0.0026 |  |
| [CVE-2026-117902](https://patchblox.com/security/data/cve/CVE-2026-117902.md) | High | firefox-esr: Use-after-free in the Layout: Text and Fonts component | 7.5 | 0.0026 |  |
| [CVE-2026-117913](https://patchblox.com/security/data/cve/CVE-2026-117913.md) | High | firefox-esr: Use-after-free in the SVG component | 7.5 | 0.0026 |  |
| [CVE-2026-117916](https://patchblox.com/security/data/cve/CVE-2026-117916.md) | High | firefox-esr: Use-after-free in the XSLT component | 7.5 | 0.0026 |  |
| [CVE-2026-117957](https://patchblox.com/security/data/cve/CVE-2026-117957.md) | High | firefox-esr: Cryptographic issue in the WebRTC: Networking component | 8.1 | 0.0025 |  |
| [CVE-2026-117912](https://patchblox.com/security/data/cve/CVE-2026-117912.md) | High | firefox-esr: Same-origin policy bypass in the CSS Parsing and Computation component | 8.1 | 0.0021 |  |
| [CVE-2026-117860](https://patchblox.com/security/data/cve/CVE-2026-117860.md) | High | firefox-esr: Same-origin policy bypass in the DOM: Navigation component | 8.1 | 0.0020 |  |
| [CVE-2026-117928](https://patchblox.com/security/data/cve/CVE-2026-117928.md) | High | firefox-esr: Same-origin policy bypass in the CSS Parsing and Computation component | 8.1 | 0.0020 |  |
| [CVE-2026-117965](https://patchblox.com/security/data/cve/CVE-2026-117965.md) | High | firefox-esr: Same-origin policy bypass in the Address Bar component | 8.1 | 0.0020 |  |
| [CVE-2026-117966](https://patchblox.com/security/data/cve/CVE-2026-117966.md) | High | firefox-esr: Site isolation issue in the Networking: HTTP component | 8.4 | 0.0020 |  |
| [CVE-2026-117958](https://patchblox.com/security/data/cve/CVE-2026-117958.md) | High | firefox-esr: Site isolation issue in the Networking: HTTP component | 8.1 | 0.0019 |  |
| [CVE-2026-117976](https://patchblox.com/security/data/cve/CVE-2026-117976.md) | High | thunderbird: Site isolation issue in the DOM: Navigation component | 8.1 | 0.0019 |  |
| [CVE-2026-117863](https://patchblox.com/security/data/cve/CVE-2026-117863.md) | Routine | firefox-esr: Information disclosure due to uninitialized memory in the Audio/Video component | 6.5 | 0.0039 |  |
| [CVE-2026-117992](https://patchblox.com/security/data/cve/CVE-2026-117992.md) | Routine | firefox-esr: Information disclosure in the CSS Parsing and Computation component | 6.5 | 0.0039 |  |
| [CVE-2026-117960](https://patchblox.com/security/data/cve/CVE-2026-117960.md) | Routine | firefox-esr: Spoofing issue in the DOM: Core & HTML component | 6.1 | 0.0029 |  |
| [CVE-2026-117893](https://patchblox.com/security/data/cve/CVE-2026-117893.md) | Routine | firefox-esr: Incorrect boundary conditions in the Security: PSM component | 5.4 | 0.0028 |  |
| [CVE-2026-117933](https://patchblox.com/security/data/cve/CVE-2026-117933.md) | Routine | thunderbird: Frame poisoning in the CSS Parsing and Computation component | 6.5 | 0.0027 |  |
| [CVE-2026-117885](https://patchblox.com/security/data/cve/CVE-2026-117885.md) | Routine | thunderbird: Use-after-free in the Layout: Grid component | 6.3 | 0.0026 |  |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.