# RLSA-2026:89757: firefox security update RLSA-2026:89757, released November 7, 2026, fixes 48 CVEs in firefox (version 0:153.5.0-1.el9_8). None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/rlsa-2026-89757 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-109745, rated Critical) - CVEs: 48, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://errata.rockylinux.org/RLSA-2026:89757 ## Applies to | Product | Release | Fixed in | |---|---|---| | [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | rocky 9 | 0:153.5.0-1.el9_8 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-109745](https://patchblox.com/security/data/cve/CVE-2026-109745.md) | Urgent | firefox-esr: Sandbox escape due to uninitialized memory in the DOM: Web Serial component | 9.6 | 0.0035 | | | [CVE-2026-109708](https://patchblox.com/security/data/cve/CVE-2026-109708.md) | Urgent | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Networking component | 9.6 | 0.0033 | | | [CVE-2026-109705](https://patchblox.com/security/data/cve/CVE-2026-109705.md) | Urgent | thunderbird: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component | 9.6 | 0.0033 | | | [CVE-2026-109707](https://patchblox.com/security/data/cve/CVE-2026-109707.md) | Urgent | firefox-esr: Sandbox escape due to use-after-free in the Networking component | 9.6 | 0.0033 | | | [CVE-2026-45186](https://patchblox.com/security/data/cve/CVE-2026-45186.md) | High | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | 8.2 | 0.0048 | | | [CVE-2026-109733](https://patchblox.com/security/data/cve/CVE-2026-109733.md) | High | thunderbird: JIT miscompilation in the JavaScript Engine: JIT component | 8.8 | 0.0046 | | | [CVE-2026-109704](https://patchblox.com/security/data/cve/CVE-2026-109704.md) | High | firefox: Privilege escalation in the Application Update component | 8.2 | 0.0041 | | | [CVE-2026-109730](https://patchblox.com/security/data/cve/CVE-2026-109730.md) | High | thunderbird: Integer overflow in the Graphics component | 8.8 | 0.0037 | | | [CVE-2026-109743](https://patchblox.com/security/data/cve/CVE-2026-109743.md) | High | thunderbird: Privilege escalation in the Panning and Zooming component | 8.8 | 0.0035 | | | [CVE-2026-109762](https://patchblox.com/security/data/cve/CVE-2026-109762.md) | High | firefox-esr: Incorrect boundary conditions in the SVG component | 8.8 | 0.0035 | | | [CVE-2026-109740](https://patchblox.com/security/data/cve/CVE-2026-109740.md) | High | firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Secu... | 8.2 | 0.0035 | | | [CVE-2026-109753](https://patchblox.com/security/data/cve/CVE-2026-109753.md) | High | thunderbird: Incorrect boundary conditions in the Layout component | 8.1 | 0.0034 | | | [CVE-2026-109737](https://patchblox.com/security/data/cve/CVE-2026-109737.md) | High | firefox-esr: Mitigation bypass in the Enterprise Policies component | 8.1 | 0.0034 | | | [CVE-2026-109760](https://patchblox.com/security/data/cve/CVE-2026-109760.md) | High | firefox-esr: Mitigation bypass in the Networking: HTTP component | 8.1 | 0.0034 | | | [CVE-2026-109709](https://patchblox.com/security/data/cve/CVE-2026-109709.md) | High | thunderbird: Information disclosure, privilege escalation in the Security: Process Sandboxing component | 8.8 | 0.0033 | | | [CVE-2026-109736](https://patchblox.com/security/data/cve/CVE-2026-109736.md) | High | firefox-esr: Frame poisoning in the Layout component | 8.1 | 0.0032 | | | [CVE-2026-109744](https://patchblox.com/security/data/cve/CVE-2026-109744.md) | High | firefox-esr: Other issue in the DOM: File component | 8.1 | 0.0032 | | | [CVE-2026-109754](https://patchblox.com/security/data/cve/CVE-2026-109754.md) | High | firefox-esr: Incorrect boundary conditions in the DOM: Editor component | 8.1 | 0.0032 | | | [CVE-2026-109756](https://patchblox.com/security/data/cve/CVE-2026-109756.md) | High | thunderbird: Privilege escalation in the DOM: Navigation component | 8.8 | 0.0032 | | | [CVE-2026-109715](https://patchblox.com/security/data/cve/CVE-2026-109715.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine component | 8.8 | 0.0031 | | | [CVE-2026-109716](https://patchblox.com/security/data/cve/CVE-2026-109716.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine component | 8.8 | 0.0031 | | | [CVE-2026-109722](https://patchblox.com/security/data/cve/CVE-2026-109722.md) | High | firefox-esr: JIT miscompilation in the JavaScript Engine: JIT component | 8.8 | 0.0031 | | | [CVE-2026-109721](https://patchblox.com/security/data/cve/CVE-2026-109721.md) | High | firefox-esr: Incorrect boundary conditions in the JavaScript Engine: JIT component | 8.8 | 0.0028 | | | [CVE-2026-109782](https://patchblox.com/security/data/cve/CVE-2026-109782.md) | High | firefox-esr: Mitigation bypass in the File Handling component | 8.3 | 0.0027 | | | [CVE-2026-109720](https://patchblox.com/security/data/cve/CVE-2026-109720.md) | High | firefox-esr: JIT miscompilation in the JavaScript: WebAssembly component | 8.8 | 0.0026 | | | [CVE-2026-109742](https://patchblox.com/security/data/cve/CVE-2026-109742.md) | High | thunderbird: Information disclosure in the PDF Viewer component | 7.5 | 0.0026 | | | [CVE-2026-109751](https://patchblox.com/security/data/cve/CVE-2026-109751.md) | High | thunderbird: Information disclosure in the Networking component | 7.5 | 0.0026 | | | [CVE-2026-109757](https://patchblox.com/security/data/cve/CVE-2026-109757.md) | High | thunderbird: Sandbox escape due to race condition in the Networking component | 8.3 | 0.0026 | | | [CVE-2026-109763](https://patchblox.com/security/data/cve/CVE-2026-109763.md) | High | thunderbird: Mitigation bypass in the File Handling component | 7.5 | 0.0025 | | | [CVE-2026-109729](https://patchblox.com/security/data/cve/CVE-2026-109729.md) | High | thunderbird: Use-after-free in the JavaScript Engine: JIT component | 8.2 | 0.0024 | | | [CVE-2026-109732](https://patchblox.com/security/data/cve/CVE-2026-109732.md) | High | thunderbird: Use-after-free in the DOM: Streams component | 8.2 | 0.0024 | | | [CVE-2026-109752](https://patchblox.com/security/data/cve/CVE-2026-109752.md) | High | thunderbird: Use-after-free in the DOM: Workers component | 8.8 | 0.0023 | | | [CVE-2026-109738](https://patchblox.com/security/data/cve/CVE-2026-109738.md) | High | thunderbird: Use-after-free in the Audio/Video: Playback component | 7.5 | 0.0023 | | | [CVE-2026-109741](https://patchblox.com/security/data/cve/CVE-2026-109741.md) | High | thunderbird: Use-after-free in the Storage: Bucket File System component | 7.5 | 0.0023 | | | [CVE-2026-109718](https://patchblox.com/security/data/cve/CVE-2026-109718.md) | High | thunderbird: Use-after-free in the XML component | 8.8 | 0.0023 | | | [CVE-2026-109725](https://patchblox.com/security/data/cve/CVE-2026-109725.md) | High | thunderbird: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0023 | | | [CVE-2026-109728](https://patchblox.com/security/data/cve/CVE-2026-109728.md) | High | thunderbird: Use-after-free in the DOM: Animation component | 8.8 | 0.0023 | | | [CVE-2026-109706](https://patchblox.com/security/data/cve/CVE-2026-109706.md) | High | thunderbird: Use-after-free in the Storage: IndexedDB component | 8.2 | 0.0023 | | | [CVE-2026-109726](https://patchblox.com/security/data/cve/CVE-2026-109726.md) | High | thunderbird: Use-after-free in the SVG component | 8.2 | 0.0023 | | | [CVE-2026-109727](https://patchblox.com/security/data/cve/CVE-2026-109727.md) | High | thunderbird: Use-after-free in the Audio/Video component | 8.2 | 0.0023 | | | [CVE-2026-109712](https://patchblox.com/security/data/cve/CVE-2026-109712.md) | High | firefox-esr: Sandbox escape due to uninitialized memory in the Graphics component | 8.8 | 0.0022 | | | [CVE-2026-109711](https://patchblox.com/security/data/cve/CVE-2026-109711.md) | High | thunderbird: Use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0022 | | | [CVE-2026-109713](https://patchblox.com/security/data/cve/CVE-2026-109713.md) | High | thunderbird: Use-after-free in the Crash Reporting component | 8.8 | 0.0022 | | | [CVE-2026-109723](https://patchblox.com/security/data/cve/CVE-2026-109723.md) | High | thunderbird: Integer overflow in the Layout: Text and Fonts component | 8.8 | 0.0022 | | | [CVE-2026-109724](https://patchblox.com/security/data/cve/CVE-2026-109724.md) | High | thunderbird: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0022 | | | [CVE-2026-109717](https://patchblox.com/security/data/cve/CVE-2026-109717.md) | High | thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component | 8.2 | 0.0022 | | | [CVE-2026-109759](https://patchblox.com/security/data/cve/CVE-2026-109759.md) | High | firefox-esr: Site isolation issue in the Networking component | 8.1 | 0.0018 | | | [CVE-2026-109719](https://patchblox.com/security/data/cve/CVE-2026-109719.md) | High | thunderbird: Race condition, use-after-free in the Graphics: CanvasWebGL component | 8.2 | 0.0017 | | --- Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.