Vulnerability-Lookup

RHSA-2026:21382

Vulnerability from csaf_redhat - Published: 2026-05-27 16:12 - Updated: 2026-05-27 19:02

Summary

Red Hat Security Advisory: firefox security update

Severity

Important

Notes

Topic: An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-8388

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript Engine: JIT component

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-8391

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the JavaScript Engine component

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-475 - Undefined Behavior for Input to API

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-8401

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Profile Backup component

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-653 - Improper Isolation or Compartmentalization

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-8946

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: Web Codecs component

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-8947

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Bindings (WebIDL) component

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-8950

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: HTTP component

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8953

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8954

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Audio/Video component

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8955

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Workers component

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8956

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Networking: JAR component

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8957

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Enterprise Policies component

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8958

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure, sandbox escape in the Security: Process Sandboxing component

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-403 - Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8961

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the Form Autofill component

3.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

CWE-472 - External Control of Assumed-Immutable Web Parameter

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2026-8962

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component

3.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2026-8968

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component

3.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2026-8970

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Security component

3.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2026-8974

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-787 - Out-of-bounds Write

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-8975

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

References

132 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:21382	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476469	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476475	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476492	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479839	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479840	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479842	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479846	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479847	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479848	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479849	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479852	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479853	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479855	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479860	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479871	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479873	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479876	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479880	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-8388	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476469	external
https://www.cve.org/CVERecord?id=CVE-2026-8388	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8388	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8391	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476475	external
https://www.cve.org/CVERecord?id=CVE-2026-8391	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8391	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8401	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476492	external
https://www.cve.org/CVERecord?id=CVE-2026-8401	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8401	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8946	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479849	external
https://www.cve.org/CVERecord?id=CVE-2026-8946	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8946	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8947	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479873	external
https://www.cve.org/CVERecord?id=CVE-2026-8947	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8947	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8950	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479853	external
https://www.cve.org/CVERecord?id=CVE-2026-8950	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8950	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8953	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479860	external
https://www.cve.org/CVERecord?id=CVE-2026-8953	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8953	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8954	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479847	external
https://www.cve.org/CVERecord?id=CVE-2026-8954	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8954	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8955	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479842	external
https://www.cve.org/CVERecord?id=CVE-2026-8955	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8955	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479839	external
https://www.cve.org/CVERecord?id=CVE-2026-8956	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8956	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8957	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479880	external
https://www.cve.org/CVERecord?id=CVE-2026-8957	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8957	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8958	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479848	external
https://www.cve.org/CVERecord?id=CVE-2026-8958	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8958	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8961	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479871	external
https://www.cve.org/CVERecord?id=CVE-2026-8961	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8961	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8962	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479876	external
https://www.cve.org/CVERecord?id=CVE-2026-8962	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8962	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8968	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479846	external
https://www.cve.org/CVERecord?id=CVE-2026-8968	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8968	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8970	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479852	external
https://www.cve.org/CVERecord?id=CVE-2026-8970	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8970	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8974	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479855	external
https://www.cve.org/CVERecord?id=CVE-2026-8974	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8974	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://access.redhat.com/security/cve/CVE-2026-8975	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479840	external
https://www.cve.org/CVERecord?id=CVE-2026-8975	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8975	external
https://www.mozilla.org/security/advisories/mfsa2…	external
https://www.mozilla.org/security/advisories/mfsa2…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)\n\n* firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)\n\n* firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)\n\n* firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)\n\n* firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)\n\n* firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)\n\n* firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)\n\n* firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)\n\n* firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)\n\n* firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)\n\n* firefox: Privilege escalation in the Security component (CVE-2026-8970)\n\n* firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)\n\n* firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)\n\n* firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)\n\n* firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)\n\n* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)\n\n* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)\n\n* firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:21382",
        "url": "https://access.redhat.com/errata/RHSA-2026:21382"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2476469",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476469"
      },
      {
        "category": "external",
        "summary": "2476475",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476475"
      },
      {
        "category": "external",
        "summary": "2476492",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476492"
      },
      {
        "category": "external",
        "summary": "2479839",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479839"
      },
      {
        "category": "external",
        "summary": "2479840",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479840"
      },
      {
        "category": "external",
        "summary": "2479842",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479842"
      },
      {
        "category": "external",
        "summary": "2479846",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479846"
      },
      {
        "category": "external",
        "summary": "2479847",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479847"
      },
      {
        "category": "external",
        "summary": "2479848",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479848"
      },
      {
        "category": "external",
        "summary": "2479849",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479849"
      },
      {
        "category": "external",
        "summary": "2479852",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479852"
      },
      {
        "category": "external",
        "summary": "2479853",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479853"
      },
      {
        "category": "external",
        "summary": "2479855",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479855"
      },
      {
        "category": "external",
        "summary": "2479860",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479860"
      },
      {
        "category": "external",
        "summary": "2479871",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479871"
      },
      {
        "category": "external",
        "summary": "2479873",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479873"
      },
      {
        "category": "external",
        "summary": "2479876",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479876"
      },
      {
        "category": "external",
        "summary": "2479880",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479880"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21382.json"
      }
    ],
    "title": "Red Hat Security Advisory: firefox security update",
    "tracking": {
      "current_release_date": "2026-05-27T19:02:19+00:00",
      "generator": {
        "date": "2026-05-27T19:02:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2026:21382",
      "initial_release_date": "2026-05-27T16:12:45+00:00",
      "revision_history": [
        {
          "date": "2026-05-27T16:12:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-27T16:12:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-27T19:02:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.11.0-1.el8_10.src",
                "product": {
                  "name": "firefox-0:140.11.0-1.el8_10.src",
                  "product_id": "firefox-0:140.11.0-1.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.11.0-1.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.11.0-1.el8_10.aarch64",
                "product": {
                  "name": "firefox-0:140.11.0-1.el8_10.aarch64",
                  "product_id": "firefox-0:140.11.0-1.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.11.0-1.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
                "product": {
                  "name": "firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
                  "product_id": "firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.11.0-1.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
                "product": {
                  "name": "firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
                  "product_id": "firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.11.0-1.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.11.0-1.el8_10.ppc64le",
                "product": {
                  "name": "firefox-0:140.11.0-1.el8_10.ppc64le",
                  "product_id": "firefox-0:140.11.0-1.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.11.0-1.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
                "product": {
                  "name": "firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
                  "product_id": "firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.11.0-1.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
                "product": {
                  "name": "firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
                  "product_id": "firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.11.0-1.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.11.0-1.el8_10.x86_64",
                "product": {
                  "name": "firefox-0:140.11.0-1.el8_10.x86_64",
                  "product_id": "firefox-0:140.11.0-1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.11.0-1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.11.0-1.el8_10.x86_64",
                "product": {
                  "name": "firefox-debugsource-0:140.11.0-1.el8_10.x86_64",
                  "product_id": "firefox-debugsource-0:140.11.0-1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.11.0-1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
                "product": {
                  "name": "firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
                  "product_id": "firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.11.0-1.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.11.0-1.el8_10.s390x",
                "product": {
                  "name": "firefox-0:140.11.0-1.el8_10.s390x",
                  "product_id": "firefox-0:140.11.0-1.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.11.0-1.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.11.0-1.el8_10.s390x",
                "product": {
                  "name": "firefox-debugsource-0:140.11.0-1.el8_10.s390x",
                  "product_id": "firefox-debugsource-0:140.11.0-1.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.11.0-1.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
                "product": {
                  "name": "firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
                  "product_id": "firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.11.0-1.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.11.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64"
        },
        "product_reference": "firefox-0:140.11.0-1.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.11.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le"
        },
        "product_reference": "firefox-0:140.11.0-1.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.11.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x"
        },
        "product_reference": "firefox-0:140.11.0-1.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.11.0-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src"
        },
        "product_reference": "firefox-0:140.11.0-1.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.11.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64"
        },
        "product_reference": "firefox-0:140.11.0-1.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.11.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64"
        },
        "product_reference": "firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.11.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x"
        },
        "product_reference": "firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.11.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.11.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64"
        },
        "product_reference": "firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.11.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le"
        },
        "product_reference": "firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.11.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x"
        },
        "product_reference": "firefox-debugsource-0:140.11.0-1.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.11.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        },
        "product_reference": "firefox-debugsource-0:140.11.0-1.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-8388",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-05-12T14:01:26.546248+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476469"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the JavaScript Engine: JIT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine: JIT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8388"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476469",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476469"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8388",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8388"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8388",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8388"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8388",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8388"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8388",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8388"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8388",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8388"
        }
      ],
      "release_date": "2026-05-12T12:36:10.633000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine: JIT component"
    },
    {
      "cve": "CVE-2026-8391",
      "cwe": {
        "id": "CWE-475",
        "name": "Undefined Behavior for Input to API"
      },
      "discovery_date": "2026-05-12T14:01:57.656924+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476475"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nOther issue in the JavaScript Engine component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Other issue in the JavaScript Engine component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8391"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476475",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476475"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8391",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8391"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8391",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8391"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8391",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8391"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8391",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8391"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8391",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8391"
        }
      ],
      "release_date": "2026-05-12T12:36:15.548000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Other issue in the JavaScript Engine component"
    },
    {
      "cve": "CVE-2026-8401",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-05-12T15:01:19.809211+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476492"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape in the Profile Backup component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape in the Profile Backup component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8401"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476492",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476492"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8401"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8401",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8401"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8401",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8401"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8401",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8401"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8401",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8401"
        }
      ],
      "release_date": "2026-05-12T14:24:33.320000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Sandbox escape in the Profile Backup component"
    },
    {
      "cve": "CVE-2026-8946",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-05-19T14:01:55.843709+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Audio/Video: Web Codecs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8946"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8946",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8946"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8946",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8946"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8946",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8946"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8946",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8946"
        }
      ],
      "release_date": "2026-05-19T12:29:36.254000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component"
    },
    {
      "cve": "CVE-2026-8947",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-19T14:03:11.971804+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479873"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Bindings (WebIDL) component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8947"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479873",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479873"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8947",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8947"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8947",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8947"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8947",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8947"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8947",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8947"
        }
      ],
      "release_date": "2026-05-19T12:29:37.800000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component"
    },
    {
      "cve": "CVE-2026-8950",
      "discovery_date": "2026-05-19T14:02:08.208001+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479853"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the Networking: HTTP component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Same-origin policy bypass in the Networking: HTTP component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8950"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479853",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479853"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8950",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8950"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8950",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8950"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8950",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8950"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8950",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8950"
        }
      ],
      "release_date": "2026-05-19T12:29:42.239000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Same-origin policy bypass in the Networking: HTTP component"
    },
    {
      "cve": "CVE-2026-8953",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-19T14:02:27.083725+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479860"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the Disability Access APIs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape due to use-after-free in the Disability Access APIs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8953"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479860",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479860"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8953"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8953",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8953"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8953",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8953"
        }
      ],
      "release_date": "2026-05-19T12:29:46.724000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Sandbox escape due to use-after-free in the Disability Access APIs component"
    },
    {
      "cve": "CVE-2026-8954",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-05-19T14:01:49.594978+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479847"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Audio/Video component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8954"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479847",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479847"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8954"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8954",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8954"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8954",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8954"
        }
      ],
      "release_date": "2026-05-19T12:29:48.213000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component"
    },
    {
      "cve": "CVE-2026-8955",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-05-19T14:01:30.354865+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479842"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Workers component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Workers component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8955"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479842",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479842"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8955"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8955",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8955"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8955",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8955"
        }
      ],
      "release_date": "2026-05-19T12:29:49.649000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Workers component"
    },
    {
      "cve": "CVE-2026-8956",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-05-19T14:01:17.684103+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInteger overflow in the Networking: JAR component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Integer overflow in the Networking: JAR component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8956"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8956"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8956",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8956"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8956",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8956"
        }
      ],
      "release_date": "2026-05-19T12:29:51.114000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Integer overflow in the Networking: JAR component"
    },
    {
      "cve": "CVE-2026-8957",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-05-19T14:03:36.643215+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479880"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Enterprise Policies component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Privilege escalation in the Enterprise Policies component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8957"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479880",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479880"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8957",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8957"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8957",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8957"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8957",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8957"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8957",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8957"
        }
      ],
      "release_date": "2026-05-19T12:29:52.576000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Privilege escalation in the Enterprise Policies component"
    },
    {
      "cve": "CVE-2026-8958",
      "cwe": {
        "id": "CWE-403",
        "name": "Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027)"
      },
      "discovery_date": "2026-05-19T14:01:52.791414+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479848"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure, sandbox escape in the Security: Process Sandboxing component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8958"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479848",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479848"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8958",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8958"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8958",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8958"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8958",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8958"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8958",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8958"
        }
      ],
      "release_date": "2026-05-19T12:29:54.014000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component"
    },
    {
      "cve": "CVE-2026-8961",
      "cwe": {
        "id": "CWE-472",
        "name": "External Control of Assumed-Immutable Web Parameter"
      },
      "discovery_date": "2026-05-19T14:03:05.012007+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479871"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSpoofing issue in the Form Autofill component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Spoofing issue in the Form Autofill component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8961"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479871",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479871"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8961",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8961"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8961",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8961"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8961",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8961"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8961",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8961"
        }
      ],
      "release_date": "2026-05-19T12:29:58.485000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: Spoofing issue in the Form Autofill component"
    },
    {
      "cve": "CVE-2026-8962",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-05-19T14:03:23.750898+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479876"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the DOM: Security component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Mitigation bypass in the DOM: Security component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8962"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479876",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479876"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8962",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8962"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8962",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8962"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8962",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8962"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8962",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8962"
        }
      ],
      "release_date": "2026-05-19T12:29:59.947000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: Mitigation bypass in the DOM: Security component"
    },
    {
      "cve": "CVE-2026-8968",
      "discovery_date": "2026-05-19T14:01:46.326033+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479846"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nDenial-of-service due to invalid pointer in the Audio/Video: Web Codecs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8968"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479846",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479846"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8968",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8968"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8968",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8968"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8968",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8968"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8968",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8968"
        }
      ],
      "release_date": "2026-05-19T12:30:14.026000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component"
    },
    {
      "cve": "CVE-2026-8970",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-05-19T14:02:04.726313+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479852"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Security component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Privilege escalation in the Security component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8970"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479852",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479852"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8970",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8970"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8970",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8970"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8970",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8970"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8970",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8970"
        }
      ],
      "release_date": "2026-05-19T12:30:17.224000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: Privilege escalation in the Security component"
    },
    {
      "cve": "CVE-2026-8974",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-05-19T14:02:10.941067+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479855"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8974"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479855",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479855"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8974",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8974"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8974",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8974"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8974",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8974"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8974",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8974"
        }
      ],
      "release_date": "2026-05-19T12:30:23.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151"
    },
    {
      "cve": "CVE-2026-8975",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-05-19T14:01:22.742527+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8975"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8975",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8975"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8975",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8975"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8975",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8975"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8975",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8975"
        }
      ],
      "release_date": "2026-05-19T12:30:24.616000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T16:12:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21382"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.11.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.11.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151"
    }
  ]
}

CVE-2026-8388 (GCVE-0-2026-8388)

Vulnerability from cvelistv5 – Published: 2026-05-12 12:36 – Updated: 2026-05-19 17:10

Title

Incorrect boundary conditions in the JavaScript Engine: JIT component

Summary

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2036978
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.36 , ≤ 115.* (rpm) Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 150.0.3 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ * (rpm)

Credits

ggwhyp

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T18:28:57.252588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T18:29:06.860Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.36",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150.0.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ggwhyp"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11."
            }
          ],
          "value": "Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:46.244Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2036978"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-45/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-47/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Incorrect boundary conditions in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8388",
    "datePublished": "2026-05-12T12:36:10.633Z",
    "dateReserved": "2026-05-12T12:36:09.855Z",
    "dateUpdated": "2026-05-19T17:10:46.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8391 (GCVE-0-2026-8391)

Vulnerability from cvelistv5 – Published: 2026-05-12 12:36 – Updated: 2026-05-19 17:10

Title

Other issue in the JavaScript Engine component

Summary

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-20 - Improper Input Validation
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2038575
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.36 , ≤ 115.* (rpm) Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 150.0.3 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ * (rpm)

Credits

ggwhyp

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:47:19.047188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:47:30.418Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.36",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150.0.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ggwhyp"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11."
            }
          ],
          "value": "Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:47.079Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2038575"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-45/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-47/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Other issue in the JavaScript Engine component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8391",
    "datePublished": "2026-05-12T12:36:15.548Z",
    "dateReserved": "2026-05-12T12:36:14.816Z",
    "dateUpdated": "2026-05-19T17:10:47.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8401 (GCVE-0-2026-8401)

Vulnerability from cvelistv5 – Published: 2026-05-12 14:24 – Updated: 2026-05-19 17:10

Title

Sandbox escape in the Profile Backup component

Summary

Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-693 - Protection Mechanism Failure

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2038679
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.36 , ≤ 115.* (rpm) Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 150.0.3 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ * (rpm)

Credits

ggwhyp

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T16:46:22.547730Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T19:54:10.869Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.36",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150.0.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ggwhyp"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11."
            }
          ],
          "value": "Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:47.433Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2038679"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-45/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-47/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Sandbox escape in the Profile Backup component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8401",
    "datePublished": "2026-05-12T14:24:33.320Z",
    "dateReserved": "2026-05-12T14:19:41.837Z",
    "dateUpdated": "2026-05-19T17:10:47.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8946 (GCVE-0-2026-8946)

Vulnerability from cvelistv5 – Published: 2026-05-19 12:29 – Updated: 2026-05-19 17:10

Title

Incorrect boundary conditions in the Audio/Video: Web Codecs component

Summary

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2029070
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.36 , ≤ 115.* (rpm) Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)

Credits

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8946",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T14:09:24.484354Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T14:11:28.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.36",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "zx"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
            }
          ],
          "value": "Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:45.651Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2029070"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-47/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-50/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Incorrect boundary conditions in the Audio/Video: Web Codecs component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8946",
    "datePublished": "2026-05-19T12:29:36.254Z",
    "dateReserved": "2026-05-19T12:29:35.532Z",
    "dateUpdated": "2026-05-19T17:10:45.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8947 (GCVE-0-2026-8947)

Vulnerability from cvelistv5 – Published: 2026-05-19 12:29 – Updated: 2026-05-19 17:10

Title

Use-after-free in the DOM: Bindings (WebIDL) component

Summary

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2038439
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.36 , ≤ 115.* (rpm) Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)

Credits

Satoki Tsuji

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8947",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T14:14:49.904157Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T14:15:12.387Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.36",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Satoki Tsuji"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
            }
          ],
          "value": "Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:46.663Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2038439"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-47/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-50/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Use-after-free in the DOM: Bindings (WebIDL) component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8947",
    "datePublished": "2026-05-19T12:29:37.800Z",
    "dateReserved": "2026-05-19T12:29:37.072Z",
    "dateUpdated": "2026-05-19T17:10:46.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8950 (GCVE-0-2026-8950)

Vulnerability from cvelistv5 – Published: 2026-05-19 12:29 – Updated: 2026-05-19 17:10

Title

Same-origin policy bypass in the Networking: HTTP component

Summary

Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-346 - Origin Validation Error

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1965430
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)

Credits

Jakub Szymsza

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.3,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T15:47:45.885624Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T15:49:32.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Szymsza"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
            }
          ],
          "value": "Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:48.079Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1965430"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-50/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Same-origin policy bypass in the Networking: HTTP component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8950",
    "datePublished": "2026-05-19T12:29:42.239Z",
    "dateReserved": "2026-05-19T12:29:41.562Z",
    "dateUpdated": "2026-05-19T17:10:48.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8953 (GCVE-0-2026-8953)

Vulnerability from cvelistv5 – Published: 2026-05-19 12:29 – Updated: 2026-05-19 17:10

Title

Sandbox escape due to use-after-free in the Disability Access APIs component

Summary

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2029511
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.36 , ≤ 115.* (rpm) Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)

Credits

stevej

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8953",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T16:02:27.035386Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T16:03:01.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.36",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "stevej"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:48.519Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2029511"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-47/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-50/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the Disability Access APIs component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8953",
    "datePublished": "2026-05-19T12:29:46.724Z",
    "dateReserved": "2026-05-19T12:29:46.018Z",
    "dateUpdated": "2026-05-19T17:10:48.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8954 (GCVE-0-2026-8954)

Vulnerability from cvelistv5 – Published: 2026-05-19 12:29 – Updated: 2026-05-19 17:10

Title

Incorrect boundary conditions, integer overflow in the Audio/Video component

Summary

Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2030747
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)

Credits

Ameen Basha M K

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T14:15:45.643476Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T14:16:04.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ameen Basha M K"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
            }
          ],
          "value": "Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:48.872Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2030747"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-50/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Incorrect boundary conditions, integer overflow in the Audio/Video component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8954",
    "datePublished": "2026-05-19T12:29:48.213Z",
    "dateReserved": "2026-05-19T12:29:47.489Z",
    "dateUpdated": "2026-05-19T17:10:48.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8955 (GCVE-0-2026-8955)

Vulnerability from cvelistv5 – Published: 2026-05-19 12:29 – Updated: 2026-05-20 15:37

Title

Privilege escalation in the DOM: Workers component

Summary

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2031064
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)

Credits

lebr0nli

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T03:55:27.801777Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T15:37:35.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "lebr0nli"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
            }
          ],
          "value": "Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:49.147Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2031064"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-50/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Privilege escalation in the DOM: Workers component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8955",
    "datePublished": "2026-05-19T12:29:49.649Z",
    "dateReserved": "2026-05-19T12:29:48.978Z",
    "dateUpdated": "2026-05-20T15:37:35.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8956 (GCVE-0-2026-8956)

Vulnerability from cvelistv5 – Published: 2026-05-19 12:29 – Updated: 2026-05-19 17:10

Title

Integer overflow in the Networking: JAR component

Summary

Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2032427
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.11 , ≤ 140.* (rpm) Unaffected: 151 , ≤ * (rpm)

Credits

Yaqoub Aldurayhim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8956",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T16:37:45.418477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T16:39:48.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.11",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "151",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
            }
          ],
          "value": "Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T17:10:49.476Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2032427"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-46/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-48/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-50/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-51/"
        }
      ],
      "title": "Integer overflow in the Networking: JAR component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-8956",
    "datePublished": "2026-05-19T12:29:51.114Z",
    "dateReserved": "2026-05-19T12:29:50.365Z",
    "dateUpdated": "2026-05-19T17:10:49.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:21382

CVE-2026-8388 (GCVE-0-2026-8388)

CVE-2026-8391 (GCVE-0-2026-8391)

CVE-2026-8401 (GCVE-0-2026-8401)

CVE-2026-8946 (GCVE-0-2026-8946)

CVE-2026-8947 (GCVE-0-2026-8947)

CVE-2026-8950 (GCVE-0-2026-8950)

CVE-2026-8953 (GCVE-0-2026-8953)

CVE-2026-8954 (GCVE-0-2026-8954)

CVE-2026-8955 (GCVE-0-2026-8955)

CVE-2026-8956 (GCVE-0-2026-8956)

Tags

Sightings

Nomenclature