Mozilla Firefox ESR 153.1 Security Bulletin with 29 CVEs (UAF, EoP, Info Disclosure)

Vulnerability Overview The Mozilla Foundation released Security Advisory 2026-77, addressing multiple security vulnerabilities in Firefox ESR 153.1. These vulnerabilities include: 1. CVE-2026-74934: Graphics: Site isolation issues in the CanvasWebGL component. 2. CVE-2026-74935: DOM: Privilege escalation in the Networking component. 3. CVE-2026-74936: JavaScript: Use-after-free (UAF) issue in the WebAssembly component. 4. CVE-2026-74937: JavaScript: Use-after-free issue in the GC component. 5. CVE-2026-74938: JavaScript: Mitigation bypass in the GC component. 6. CVE-2026-74939: DOM: Privilege escalation in the Navigation component. 7. CVE-2026-74940: Graphics: Use-after-free issue in the Text component. 8. CVE-2026-74941: Graphics: Privilege escalation in the CanvasWebGL component. 9. CVE-2026-74942: Privilege escalation in the Remote Settings Client component. 10. CVE-2026-74943: Graphics: Use-after-free issue in the ImageLib component. 11. CVE-2026-74944: DOM: Use-after-free issue in the Core & HTML component. 12. CVE-2026-74945: Graphics: Information disclosure in the Text component. 13. CVE-2026-74946: Graphics: Privilege escalation in the CanvasWebGL component due to incorrect boundary conditions. 14. CVE-2026-74947: Graphics: Privilege escalation in the Graphics component due to an invalid pointer. 15. CVE-2026-74948: Graphics: Information disclosure in the Graphics component. 16. CVE-2026-74949: Graphics: Privilege escalation in the Canvas2D component due to use-after-free. 17. CVE-2026-74950: Privilege escalation in the Downloads API component. 18. CVE-2026-74953: Networking: Privilege escalation in the Cookies component. 19. CVE-2026-74954: Storage: Information disclosure in the Cache API component due to side-channel attacks. 20. CVE-2026-74955: Privilege escalation in the Request Handling component. 21. CVE-2026-74956: DOM: Same-origin policy bypass in the Service Workers component. 22. CVE-2026-74957: Safe Browsing: Mitigation bypass. 23. CVE-2026-74958: WebRTC: Information disclosure. 24. CVE-2026-74959: Storage: Mitigation bypass in the Cache API component. 25. CVE-2026-74960: WebExtensions: Site isolation issues. 26. CVE-2026-74961: Web Audio: Side-channel attacks. 27. CVE-2026-74962: Networking: Site isolation issues in the Cookies component. 28. CVE-2026-74963: Networking: Same-origin policy bypass in the Cookies component. 29. CVE-2026-74964: Graphics: Integer overflow. 30. CVE-2026-74965: Shell Integration: Privilege escalation. 31. CVE-2026-74966: Form Autofill: Information disclosure. Impact Scope These vulnerabilities affect multiple components of Firefox ESR 153.1, including Graphics, DOM, JavaScript, Networking, Storage, WebRTC, WebExtensions, Safe Browsing, Shell Integration, and Form Autofill. The severity of the vulnerabilities ranges from "High" to "Medium" and may lead to security issues such as privilege escalation, information disclosure, use-after-free, site isolation issues, same-origin policy bypass, integer overflows, side-channel attacks, and mitigation bypasses. Remediation Mozilla has fixed all the aforementioned vulnerabilities and released Firefox ESR 153.1. Users are advised to upgrade to this version as soon as possible to mitigate these security risks. POC Code or Exploit Code No specific POC code or exploit code was provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Firefox ESR 153.1 Security Bulletin with 29 CVEs (UAF, EoP, Info Disclosure)