Linux · Security advisory · September 21, 2026
ALSA-2026:69461: firefox security update
ALSA-2026:69461, released September 21, 2026, fixes 28 CVEs in firefox (version 140.16.0-1.el10_2). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
28
2 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0036
29th percentile
Priority of the 28 CVEs
Patch now 0
Urgent 2
High 26
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | almalinux 10 | 140.16.0-1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-92018 | Sandbox escape in the DOM: Core & HTML component | 9.6 | 0.0033 | None reported | |
| Urgent | CVE-2026-92032 | Sandbox escape due to invalid pointer in the Graphics component | 9.6 | 0.0032 | None reported | |
| High | CVE-2026-92005 | Use-after-free in the Audio/Video: Web Codecs component | 7.5 | 0.0036 | None reported | |
| High | CVE-2026-92006 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0033 | None reported | |
| High | CVE-2026-92022 | Use-after-free in the DOM: HTML Parser component | 8.8 | 0.0032 | None reported | |
| High | CVE-2026-92023 | Use-after-free in the XML component | 8.8 | 0.0032 | None reported | |
| High | CVE-2026-92024 | Use-after-free in the SVG component | 8.8 | 0.0032 | None reported | |
| High | CVE-2026-92025 | Use-after-free in the DOM: Navigation component | 8.8 | 0.0032 | None reported | |
| High | CVE-2026-92027 | Use-after-free in the DOM: Streams component | 8.8 | 0.0032 | None reported | |
| High | CVE-2026-92028 | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0032 | None reported | |
| High | CVE-2026-92029 | Use-after-free in the SVG component | 8.8 | 0.0032 | None reported | |
| High | CVE-2026-92016 | Use-after-free in the Disability Access APIs component | 8.8 | 0.0031 | None reported | |
| High | CVE-2026-92026 | Use-after-free in the Networking component | 8.8 | 0.0031 | None reported | |
| High | CVE-2026-92019 | Mitigation bypass in the Remote Settings Client component | 8.1 | 0.0031 | None reported | |
| High | CVE-2026-92031 | Information disclosure in the Graphics: ImageLib component | 7.5 | 0.0031 | None reported | |
| High | CVE-2026-92021 | Use-after-free in the JavaScript Engine: JIT component | 8.8 | 0.0028 | None reported | |
| High | CVE-2026-92015 | Privilege escalation in the WebExtensions component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92007 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92008 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92009 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92010 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92011 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92012 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92013 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | None reported | |
| High | CVE-2026-92020 | Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component | 8.8 | 0.0026 | None reported |
Showing 1 to 25 of 28
1Next