RHSA-2026:54180 Red Hat Firefox Security Advisory

RHSA-2026:54180 - Security Advisory Synopsis Important Security Update Type/Severity Security Advisory: Important Topic An update to Firefox is now available for Red Hat Enterprise Linux 8 & Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8 & Extended Update Support Long Life Add-on. Red Hat Product Security has rated this update as having an important security impact. A Common Vulnerability Scoring System (CVSS) base score, which provides a detailed severity rating, is available for each vulnerability via the CVE links in the References section. Description Mozilla Firefox is an open-source web browser designed for standards compliance, performance, and portability. Security Fix(es): Mozilla: Heap Buffer Overflow in JSC Encoder (Firefox) (CVE-2026-36338) Mozilla: Use-After-Free in the DOM Navigation Component (CVE-2026-35718) Mozilla: Use-After-Free in the JavaScript WebAssembly Component (CVE-2026-35719) Mozilla: Information Disclosure in the Storage - IndexedDB Component (CVE-2026-35595) Mozilla: Incorrect Boundary Conditions in the WebRTC - Audio Component (CVE-2026-35596) Mozilla: Integer Overflow in the Storage - IndexedDB Component (CVE-2026-35597) Mozilla: Use-After-Free in the Accessibility Accessible Component (CVE-2026-35598) Mozilla: Use-After-Free in the JavaScript WebAssembly Component (CVE-2026-35719) Mozilla: Memory Safety Bugs Fixed in Firefox ESR 128.12 and Firefox 133 (CVE-2026-34412) Mozilla: Same-Origin Policy Bypass in the Networking - DNS Component (CVE-2026-34392) Mozilla: JIT Miscompilation in the JavaScript Engine - JIT Component (CVE-2026-34393) Mozilla: Memory Safety Bugs Fixed in Firefox ESR 128.10 and Firefox ESR 128.11.2 (CVE-2026-34063) Mozilla: Sandbox Escape due to Use-After-Free in the Accessibility Accessible Component (CVE-2026-34032) Mozilla: Incorrect Boundary Conditions in the JavaScript WebAssembly Component (CVE-2026-33346) Mozilla: Integration Bugs in the PDF Viewer Component (CVE-2026-34770) Mozilla: Memory Safety Bugs Fixed in Firefox ESR 125.26, Firefox ESR 128.12, and Firefox 130 (CVE-2026-34346) Mozilla: Use-After-Free in the WebRTC - Audio/Video Component (CVE-2026-34402) Mozilla: Use-After-Free in the Accessibility WebExtension Component (CVE-2026-33349) Mozilla: Same-Origin Policy Bypass in the DOM Navigation Component (CVE-2026-33348) Mozilla: Incorrect Boundary Conditions in the Graphics Component (CVE-2026-33475) Mozilla: Sandbox Escape due to Use-After-Free in the DOM Navigation Component (CVE-2026-33532) Mozilla: Privilege Escalation in the DOM Navigation Component (CVE-2026-33212) Mozilla: Privilege Escalation in the DOM ContentProcess Component (CVE-2026-33470) Mozilla: Information Disclosure in the Graphics - ImageIO Component (CVE-2026-33355) Mozilla: Information Disclosure in the Framework Component (CVE-2026-33210) Mozilla: Incorrect Boundary Conditions in the WebRTC - Video Component (CVE-2026-33356) Mozilla: Integration Bugs in the DOM Networking Component (CVE-2026-33358) Mozilla: Integer Overflow in the JavaScript WebAssembly Component (CVE-2026-33359) Mozilla: Invalid Pointer in the DOM Storage - IndexedDB Component (CVE-2026-33360) Mozilla: Privilege Escalation in WebExtensions (CVE-2026-33366) Mozilla: Information Disclosure in the Networking - DNS/DNSSEC Component (CVE-2026-33442) Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11259 Affected Products Red Hat Enterprise Linux 8 for x86_64 - Extended Life Cycle Long Life 4.0 ELS Add-on Red Hat Enterprise Linux Server - 8.2.0 ELS Add-on Fixes RHSA-2026:54180 RHSA-2026:36338 Mozilla: Heap Buffer Overflow in JSC Encoder (Firefox) (CVE-2026-36338) RHSA-2026:35718 Mozilla: Use-After-Free in the DOM Navigation Component (CVE-2026-35718) RHSA-2026:35719 Mozilla: Use-After-Free in the JavaScript WebAssembly Component (CVE-2026-35719) RHSA-2026:35595 Mozilla: Information Disclosure in the Storage - IndexedDB Component (CVE-2026-35595) RHSA-2026:35596 Mozilla: Incorrect Boundary Conditions in the WebRTC - Audio Component (CVE-2026-35596) RHSA-2026:35597 Mozilla: Integer Overflow in the Storage - IndexedDB Component (CVE-2026-35597) RHSA-2026:35598 Mozilla: Use-After-Free in the Accessibility Accessible Component (CVE-2026-35598) RHSA-2026:35719 Mozilla: Use-After-Free in the JavaScript WebAssembly Component (CVE-2026-35719) RHSA-2026:34412 Mozilla: Memory Safety Bugs Fixed in Firefox ESR 128.12 and Firefox 133 (CVE-2026-34412) RHSA-2026:34392 Mozilla: Same-Origin Policy Bypass in the Networking - DNS Component (CVE-2026-34392) RHSA-2026:34393 Mozilla: JIT Miscompilation in the JavaScript Engine - JIT Component (CVE-2026-34393) RHSA-2026:34063 Mozilla: Memory Safety Bugs Fixed in Firefox ESR 128.10 and Firefox ESR 128.11.2 (CVE-2026-34063) RHSA-2026:34032 Mozilla: Sandbox Escape due to Use-After-Free in the Accessibility Accessible Component (CVE-2026-34032) RHSA-2026:33346 Mozi

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2026:54180 Red Hat Firefox Security Advisory

More from this source