Linux · Security advisory · November 7, 2026
ELSA-2026-93956: firefox security update
ELSA-2026-93956, released November 7, 2026, fixes 144 CVEs in firefox (version 0:153.6.0-1.0.1.el10_2). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
144
16 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0053
44th percentile
Priority of the 144 CVEs
Patch now 0
Urgent 16
High 122
Routine 6
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | ol 10 | 0:153.6.0-1.0.1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-117862 | firefox-esr: Privilege escalation due to incorrect boundary conditions in the Networking component | 9.8 | 0.0053 | None reported | |
| Urgent | CVE-2026-117917 | firefox-esr: Invalid pointer in the Graphics: WebRender component | 9.8 | 0.0053 | None reported | |
| Urgent | CVE-2026-117946 | firefox-esr: Incorrect boundary conditions in the JavaScript Engine component | 9.8 | 0.0053 | None reported | |
| Urgent | CVE-2026-117945 | firefox-esr: Incorrect boundary conditions in the XML component | 9.8 | 0.0051 | None reported | |
| Urgent | CVE-2026-117982 | firefox-esr: Invalid pointer in the JavaScript Engine: JIT component | 9.8 | 0.0051 | None reported | |
| Urgent | CVE-2026-117980 | firefox-esr: Use-after-free in the Graphics component | 9.8 | 0.0049 | None reported | |
| Urgent | CVE-2026-117981 | firefox-esr: Privilege escalation in the Toolkit component | 9.8 | 0.0047 | None reported | |
| Urgent | CVE-2026-117868 | firefox-esr: Sandbox escape in the DOM: Networking component | 9.6 | 0.0041 | None reported | |
| Urgent | CVE-2026-117971 | firefox-esr: Sandbox escape due to use-after-free in the Print Preview component | 9.6 | 0.0040 | None reported | |
| Urgent | CVE-2026-117861 | firefox-esr: Sandbox escape in the DOM: Navigation component | 9.6 | 0.0039 | None reported | |
| Urgent | CVE-2026-117962 | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component | 9.6 | 0.0039 | None reported | |
| Urgent | CVE-2026-117988 | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 9.6 | 0.0039 | None reported | |
| Urgent | CVE-2026-117990 | firefox-esr: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | 9.6 | 0.0039 | None reported | |
| Urgent | CVE-2026-117920 | firefox-esr: Use-after-free in the DOM: HTML Parser component | 9.6 | 0.0038 | None reported | |
| Urgent | CVE-2026-117985 | firefox-esr: Sandbox escape due to use-after-free in the Graphics component | 9.6 | 0.0038 | None reported | |
| Urgent | CVE-2026-117997 | firefox-esr: Sandbox escape due to use-after-free in the Widget component | 9.6 | 0.0038 | None reported | |
| High | CVE-2026-117925 | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0043 | None reported | |
| High | CVE-2026-117967 | firefox-esr: Mitigation bypass in the DOM: Security component | 8.8 | 0.0041 | None reported | |
| High | CVE-2026-117998 | firefox-esr: Mitigation bypass in the DOM: Push Subscriptions component | 8.8 | 0.0041 | None reported | |
| High | CVE-2026-117950 | firefox-esr: Incorrect boundary conditions in the DOM: Core & HTML component | 8.8 | 0.0041 | None reported | |
| High | CVE-2026-117979 | firefox-esr: Incorrect boundary conditions in the Graphics: WebRender component | 8.8 | 0.0041 | None reported | |
| High | CVE-2026-117869 | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 | None reported | |
| High | CVE-2026-117872 | firefox-esr: Use-after-free in the JavaScript: Standard Library component | 8.8 | 0.0040 | None reported | |
| High | CVE-2026-117881 | firefox-esr: Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 | None reported | |
| High | CVE-2026-117883 | firefox-esr: Use-after-free in the DOM: HTML Parser component | 8.8 | 0.0040 | None reported |
Showing 1 to 25 of 144
1Next