# RHSA-2026:19201: Security update for 2 packages RHSA-2026:19201, released April 30, 2026, fixes 25 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/rhsa-2026-19201 - Platform: Linux - Released: Apr 30, 2026 - Priority: High (Closes CVE-2026-6770, high severity) - CVEs: 25, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://access.redhat.com/errata/RHSA-2026:19201 ## Applies to | Product | Release | Fixed in | |---|---|---| | [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | RHEL 9 | 0:140.10.0-1.el9_8 | | [firefox-x11](https://patchblox.com/security/data/product/linux/firefox-x11.md) | RHEL 9 | 0:140.10.0-1.el9_8 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-6770](https://patchblox.com/security/data/cve/CVE-2026-6770.md) | High | Other issue in the Storage: IndexedDB component | 8.8 | 0.0388 | | | [CVE-2026-6746](https://patchblox.com/security/data/cve/CVE-2026-6746.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0095 | | | [CVE-2026-6785](https://patchblox.com/security/data/cve/CVE-2026-6785.md) | High | Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 | 8.8 | 0.0051 | | | [CVE-2026-6786](https://patchblox.com/security/data/cve/CVE-2026-6786.md) | High | Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 | 8.8 | 0.0050 | | | [CVE-2026-6757](https://patchblox.com/security/data/cve/CVE-2026-6757.md) | High | Invalid pointer in the JavaScript: WebAssembly component | 8.8 | 0.0049 | | | [CVE-2026-6750](https://patchblox.com/security/data/cve/CVE-2026-6750.md) | High | Privilege escalation in the Graphics: WebRender component | 8.8 | 0.0048 | | | [CVE-2026-6749](https://patchblox.com/security/data/cve/CVE-2026-6749.md) | High | Information disclosure due to uninitialized memory in the Graphics: Canvas2D component | 8.8 | 0.0040 | | | [CVE-2026-6747](https://patchblox.com/security/data/cve/CVE-2026-6747.md) | High | Use-after-free in the WebRTC component | 8.8 | 0.0040 | | | [CVE-2026-6748](https://patchblox.com/security/data/cve/CVE-2026-6748.md) | High | Uninitialized memory in the Audio/Video: Web Codecs component | 9.8 | 0.0040 | | | [CVE-2026-6772](https://patchblox.com/security/data/cve/CVE-2026-6772.md) | High | Incorrect boundary conditions in the Libraries component in NSS | 8.8 | 0.0039 | | | [CVE-2026-6754](https://patchblox.com/security/data/cve/CVE-2026-6754.md) | High | Use-after-free in the JavaScript Engine component | 8.8 | 0.0039 | | | [CVE-2026-6759](https://patchblox.com/security/data/cve/CVE-2026-6759.md) | High | Use-after-free in the Widget: Cocoa component | 8.8 | 0.0036 | | | [CVE-2026-6771](https://patchblox.com/security/data/cve/CVE-2026-6771.md) | High | Mitigation bypass in the DOM: Security component | 9.8 | 0.0031 | | | [CVE-2026-6751](https://patchblox.com/security/data/cve/CVE-2026-6751.md) | High | Uninitialized memory in the Audio/Video: Web Codecs component | 8.8 | 0.0031 | | | [CVE-2026-6752](https://patchblox.com/security/data/cve/CVE-2026-6752.md) | High | Incorrect boundary conditions in the WebRTC component | 8.8 | 0.0031 | | | [CVE-2026-6753](https://patchblox.com/security/data/cve/CVE-2026-6753.md) | High | Incorrect boundary conditions in the WebRTC component | 8.8 | 0.0031 | | | [CVE-2026-6766](https://patchblox.com/security/data/cve/CVE-2026-6766.md) | High | Incorrect boundary conditions in the Libraries component in NSS | 8.8 | 0.0026 | | | [CVE-2026-6764](https://patchblox.com/security/data/cve/CVE-2026-6764.md) | High | Incorrect boundary conditions in the DOM: Device Interfaces component | 8.8 | 0.0023 | | | [CVE-2026-6767](https://patchblox.com/security/data/cve/CVE-2026-6767.md) | High | Other issue in the Libraries component in NSS | 8.8 | 0.0023 | | | [CVE-2026-6769](https://patchblox.com/security/data/cve/CVE-2026-6769.md) | High | Privilege escalation in the Debugger component | 8.8 | 0.0023 | | | [CVE-2026-6761](https://patchblox.com/security/data/cve/CVE-2026-6761.md) | High | Privilege escalation in the Networking component | 8.8 | 0.0022 | | | [CVE-2026-6765](https://patchblox.com/security/data/cve/CVE-2026-6765.md) | High | Information disclosure in the Form Autofill component | 8.8 | 0.0022 | | | [CVE-2026-6763](https://patchblox.com/security/data/cve/CVE-2026-6763.md) | High | Mitigation bypass in the File Handling component | 8.8 | 0.0019 | | | [CVE-2026-6762](https://patchblox.com/security/data/cve/CVE-2026-6762.md) | High | Spoofing issue in the DOM: Core & HTML component | 8.8 | 0.0019 | | | [CVE-2026-6776](https://patchblox.com/security/data/cve/CVE-2026-6776.md) | High | Incorrect boundary conditions in the WebRTC: Networking component | 8.8 | 0.0011 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo