Linux · Security advisory · November 7, 2026

ELSA-2026-89757: Security update for 2 packages

ELSA-2026-89757, released November 7, 2026, fixes 48 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
48
4 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0048
41st percentile

Priority of the 48 CVEs

Patch now 0 Urgent 4 High 44 Routine 0

Fixed package versions

ProductReleaseFixed in
firefoxol 90:153.5.0-1.0.1.el9_8
firefox-x11ol 90:153.5.0-1.0.1.el9_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-109745 firefox-esr: Sandbox escape due to uninitialized memory in the DOM: Web Serial component 9.6 0.0035 None reported
Urgent CVE-2026-109708 firefox-esr: Sandbox escape due to incorrect boundary conditions in the Networking component 9.6 0.0033 None reported
Urgent CVE-2026-109705 thunderbird: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component 9.6 0.0033 None reported
Urgent CVE-2026-109707 firefox-esr: Sandbox escape due to use-after-free in the Networking component 9.6 0.0033 None reported
High CVE-2026-45186 In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. 8.2 0.0048 None reported
High CVE-2026-109733 thunderbird: JIT miscompilation in the JavaScript Engine: JIT component 8.8 0.0046 None reported
High CVE-2026-109704 firefox: Privilege escalation in the Application Update component 8.2 0.0041 None reported
High CVE-2026-109730 thunderbird: Integer overflow in the Graphics component 8.8 0.0037 None reported
High CVE-2026-109743 thunderbird: Privilege escalation in the Panning and Zooming component 8.8 0.0035 None reported
High CVE-2026-109762 firefox-esr: Incorrect boundary conditions in the SVG component 8.8 0.0035 None reported
High CVE-2026-109740 firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Secu... 8.2 0.0035 None reported
High CVE-2026-109753 thunderbird: Incorrect boundary conditions in the Layout component 8.1 0.0034 None reported
High CVE-2026-109737 firefox-esr: Mitigation bypass in the Enterprise Policies component 8.1 0.0034 None reported
High CVE-2026-109760 firefox-esr: Mitigation bypass in the Networking: HTTP component 8.1 0.0034 None reported
High CVE-2026-109709 thunderbird: Information disclosure, privilege escalation in the Security: Process Sandboxing component 8.8 0.0033 None reported
High CVE-2026-109736 firefox-esr: Frame poisoning in the Layout component 8.1 0.0032 None reported
High CVE-2026-109744 firefox-esr: Other issue in the DOM: File component 8.1 0.0032 None reported
High CVE-2026-109754 firefox-esr: Incorrect boundary conditions in the DOM: Editor component 8.1 0.0032 None reported
High CVE-2026-109756 thunderbird: Privilege escalation in the DOM: Navigation component 8.8 0.0032 None reported
High CVE-2026-109715 firefox-esr: Incorrect boundary conditions in the JavaScript Engine component 8.8 0.0031 None reported
High CVE-2026-109716 firefox-esr: Incorrect boundary conditions in the JavaScript Engine component 8.8 0.0031 None reported
High CVE-2026-109722 firefox-esr: JIT miscompilation in the JavaScript Engine: JIT component 8.8 0.0031 None reported
High CVE-2026-109721 firefox-esr: Incorrect boundary conditions in the JavaScript Engine: JIT component 8.8 0.0028 None reported
High CVE-2026-109782 firefox-esr: Mitigation bypass in the File Handling component 8.3 0.0027 None reported
High CVE-2026-109720 firefox-esr: JIT miscompilation in the JavaScript: WebAssembly component 8.8 0.0026 None reported
Showing 1 to 25 of 48 1Next