Mozilla Firefox Security Advisory: Multiple CVEs including UAF, Privilege Escalation, and CORS Bypass

Vulnerability Overview The Mozilla Foundation released Security Advisory 2026-76, which addresses multiple security vulnerabilities in Firefox ESR 140.14. These vulnerabilities include: 1. CVE-2026-74934: Graphics: Site isolation issue in the CanvasWebGL component. 2. CVE-2026-74935: DOM: Privilege escalation in the Networking component. 3. CVE-2026-74936: JavaScript: Use-after-free in the WebAssembly component. 4. CVE-2026-74939: DOM: Privilege escalation in the Navigation component. 5. CVE-2026-74940: Graphics: Use-after-free in the Text component. 6. CVE-2026-74941: Graphics: Privilege escalation in the CanvasWebGL component. 7. CVE-2026-74942: Privilege escalation in the Remote Settings Client component. 8. CVE-2026-74943: Graphics: Use-after-free in the ImageLib component. 9. CVE-2026-74944: DOM: Use-after-free in the Core & HTML component. 10. CVE-2026-74945: Graphics: Information disclosure in the Text component. 11. CVE-2026-74946: Graphics: Privilege escalation in the CanvasWebGL component (due to incorrect boundary conditions). 12. CVE-2026-74948: Graphics: Information disclosure. 13. CVE-2026-74949: Graphics: Privilege escalation in the Canvas2D component (due to use-after-free). 14. CVE-2026-74953: Networking: Privilege escalation in the Cookies component. 15. CVE-2026-74957: Bypass of mitigation mechanisms in the Safe Browsing component. 16. CVE-2026-74959: Bypass of mitigation mechanisms in the Cache API component. 17. CVE-2026-74960: Site isolation issue in the WebExtensions component. 18. CVE-2026-74962: Site isolation issue in the Cookies component. 19. CVE-2026-74963: Same-Origin Policy (SOP) bypass in the Cookies component. 20. CVE-2026-74964: Integer overflow in the Graphics component. 21. CVE-2026-74965: Privilege escalation in the Shell Integration component. 22. CVE-2026-74967: Same-Origin Policy (SOP) bypass in the Playback component. 23. CVE-2026-74969: Use-after-free in the Text and Fonts component. 24. CVE-2026-74971: Information disclosure in the UI Events & Focus Handling component. 25. CVE-2026-74972: Information disclosure in the Push Subscriptions component. 26. CVE-2026-74973: Race condition and use-after-free in the Graphics component. 27. CVE-2026-74974: Same-Origin Policy (SOP) bypass in the ImageLib component. 28. CVE-2026-74976: JIT compilation error in the JIT component. 29. CVE-2026-74983: Bypass of mitigation mechanisms in the Data Loss Prevention component. 30. CVE-2026-74987: Internally discovered vulnerabilities in Firefox ESR 140.14, Firefox ESR 153.1, and Firefox 154. Affected Versions Firefox ESR 140.14 Firefox ESR 153.1 Firefox 154 Remediation Upgrade to Firefox ESR 140.14 Upgrade to Firefox ESR 153.1 Upgrade to Firefox 154 Proof of Concept (PoC) or Exploit Code No specific PoC code or exploit code was included in the source material. Summary The Mozilla Foundation released Security Advisory 2026-76, addressing multiple security vulnerabilities in Firefox ESR 140.14, Firefox ESR 153.1, and Firefox 154. These vulnerabilities include site isolation issues, privilege escalation, use-after-free errors, information disclosure, Same-Origin Policy (SOP) bypasses, integer overflows, race conditions, JIT compilation errors, and bypasses of mitigation mechanisms. Users are advised to update to the latest versions as soon as possible to mitigate these risks.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Firefox Security Advisory: Multiple CVEs including UAF, Privilege Escalation, and CORS Bypass