RHSA-2026:10766: firefox security update

RHSA-2026:10766, released April 30, 2026, fixes 26 CVEs in firefox (version 0:140.10.0-1.el8_10). One of them is being exploited (CVE-2026-111497); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV1 publicly disclosed

CVEs closed

None rated Critical

Exploited

CVE-2026-111497

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.8264

99th percentile

Priority of the 26 CVEs

Patch now 1
                                Urgent 0
                                High 25
                                Routine 0

Fixed package versions

Product	Release	Fixed in
firefox	RHEL 8	0:140.10.0-1.el8_10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2026-111497	Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder	9.8	0.8264	KEVDisclosedExploited
High	CVE-2026-6770	Other issue in the Storage: IndexedDB component	8.8	0.0388	None reported
High	CVE-2026-6746	Use-after-free in the DOM: Core & HTML component	8.8	0.0095	None reported
High	CVE-2026-6785	Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150	8.8	0.0051	None reported
High	CVE-2026-6786	Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150	8.8	0.0050	None reported
High	CVE-2026-6757	Invalid pointer in the JavaScript: WebAssembly component	8.8	0.0049	None reported
High	CVE-2026-6750	Privilege escalation in the Graphics: WebRender component	8.8	0.0048	None reported
High	CVE-2026-6749	Information disclosure due to uninitialized memory in the Graphics: Canvas2D component	8.8	0.0040	None reported
High	CVE-2026-6747	Use-after-free in the WebRTC component	8.8	0.0040	None reported
High	CVE-2026-6748	Uninitialized memory in the Audio/Video: Web Codecs component	9.8	0.0040	None reported
High	CVE-2026-6772	Incorrect boundary conditions in the Libraries component in NSS	8.8	0.0039	None reported
High	CVE-2026-6754	Use-after-free in the JavaScript Engine component	8.8	0.0039	None reported
High	CVE-2026-6759	Use-after-free in the Widget: Cocoa component	8.8	0.0036	None reported
High	CVE-2026-6771	Mitigation bypass in the DOM: Security component	9.8	0.0031	None reported
High	CVE-2026-6751	Uninitialized memory in the Audio/Video: Web Codecs component	8.8	0.0031	None reported
High	CVE-2026-6752	Incorrect boundary conditions in the WebRTC component	8.8	0.0031	None reported
High	CVE-2026-6753	Incorrect boundary conditions in the WebRTC component	8.8	0.0031	None reported
High	CVE-2026-6766	Incorrect boundary conditions in the Libraries component in NSS	8.8	0.0026	None reported
High	CVE-2026-6764	Incorrect boundary conditions in the DOM: Device Interfaces component	8.8	0.0023	None reported
High	CVE-2026-6767	Other issue in the Libraries component in NSS	8.8	0.0023	None reported
High	CVE-2026-6769	Privilege escalation in the Debugger component	8.8	0.0023	None reported
High	CVE-2026-6761	Privilege escalation in the Networking component	8.8	0.0022	None reported
High	CVE-2026-6765	Information disclosure in the Form Autofill component	8.8	0.0022	None reported
High	CVE-2026-6763	Mitigation bypass in the File Handling component	8.8	0.0019	None reported
High	CVE-2026-6762	Spoofing issue in the DOM: Core & HTML component	8.8	0.0019	None reported

Also fixes CVE-2026-111497

RHSA-2026:19463
thunderbird on RHEL 10
RHSA-2026:13537
thunderbird on RHEL 8
ELSA-2026-13537
thunderbird on ol 8
ALSA-2026:13537
thunderbird on almalinux 8
RHSA-2026:17690
firefox on RHEL 10
ALSA-2026:10766
firefox on almalinux 8
ELSA-2026-10766
firefox on ol 8
ALAS2023-2026-3367
aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 and 19 more on amzn 2023

Vendor advisory

https://access.redhat.com/errata/RHSA-2026:10766

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/rhsa-2026-10766">RHSA-2026:10766 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.