Mozilla Firefox 153 安全公告：多组件高危漏洞修复（含UAF/沙箱逃逸）

漏洞概述 Mozilla Foundation 发布了安全公告 2026-68，指出在 Firefox 153 中修复了多个安全漏洞。这些漏洞涉及多个组件，包括 DOM、WebRTC、JavaScript、Audio/Video、Graphics、Networking、PDF Viewer、Service Workers 等。 影响范围 高影响：多个漏洞被标记为高影响，包括： - CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component - CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component - CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component - CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component - CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component - CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component - CVE-2026-16364: Incorrect boundary conditions in the Audio/Video: Playback component - CVE-2026-16365: Privilege escalation in the DOM: Workers component - CVE-2026-16366: Privilege escalation in the DOM: Navigation component - CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component - CVE-2026-16354: Information disclosure in the Graphics: ImageLib component - CVE-2026-16367: Sandbox escape due to invalid pointer in the Disability Access APIs component - CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component - CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component - CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component - CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component - CVE-2026-16357: Incorrect boundary conditions in the Graphics component 中等影响：部分漏洞被标记为中等影响，包括： - CVE-2026-16370: Mitigation bypass in the DOM: Networking component - CVE-2026-16371: Privilege escalation in the DOM: Navigation component - CVE-2026-16372: Privilege escalation in the DOM: Content Processes component - CVE-2026-16373: Information disclosure in the Privacy component in Firefox for Android - CVE-2026-16374: Information disclosure in the Framework component in DevTools - CVE-2026-16375: Site isolation issue in the Networking: HTTP component - CVE-2026-16376: Denial-of-service in the Graphics: WebGPU component - CVE-2026-16377: Mitigation bypass in the PDF Viewer component - CVE-2026-16378: Other issue in the DOM: Copy & Paste and Drag & Drop component - CVE-2026-16379: Privilege escalation in the DOM: Content Processes component - CVE-2026-16358: Site isolation issue in the Graphics: WebRender component - CVE-2026-16380: Mitigation bypass in the Networking component - CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component - CVE-2026-16382: Mitigation bypass in the DOM: Service Workers component 修复方案 所有列出的漏洞已在 Firefox 153 中修复。建议用户尽快升级到 Firefox 153 以解决这些安全问题。 POC 代码或利用代码 页面中未包含具体的 POC 代码或利用代码。

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Mozilla Firefox 153 安全公告：多组件高危漏洞修复（含UAF/沙箱逃逸）

目标达成感谢每一位支持者 — 我们达成了 100% 目标！