ELSA-2026-94405: firefox security update

ELSA-2026-94405, released November 7, 2026, fixes 144 CVEs in firefox (version 0:153.6.0-1.0.1.el8_10). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

144

16 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0053

44th percentile

Priority of the 144 CVEs

Patch now 0
                                Urgent 16
                                High 122
                                Routine 6

Fixed package versions

Product	Release	Fixed in
firefox	ol 8	0:153.6.0-1.0.1.el8_10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-117862	firefox-esr: Privilege escalation due to incorrect boundary conditions in the Networking component	9.8	0.0053	None reported
Urgent	CVE-2026-117917	firefox-esr: Invalid pointer in the Graphics: WebRender component	9.8	0.0053	None reported
Urgent	CVE-2026-117946	firefox-esr: Incorrect boundary conditions in the JavaScript Engine component	9.8	0.0053	None reported
Urgent	CVE-2026-117945	firefox-esr: Incorrect boundary conditions in the XML component	9.8	0.0051	None reported
Urgent	CVE-2026-117982	firefox-esr: Invalid pointer in the JavaScript Engine: JIT component	9.8	0.0051	None reported
Urgent	CVE-2026-117980	firefox-esr: Use-after-free in the Graphics component	9.8	0.0049	None reported
Urgent	CVE-2026-117981	firefox-esr: Privilege escalation in the Toolkit component	9.8	0.0047	None reported
Urgent	CVE-2026-117868	firefox-esr: Sandbox escape in the DOM: Networking component	9.6	0.0041	None reported
Urgent	CVE-2026-117971	firefox-esr: Sandbox escape due to use-after-free in the Print Preview component	9.6	0.0040	None reported
Urgent	CVE-2026-117861	firefox-esr: Sandbox escape in the DOM: Navigation component	9.6	0.0039	None reported
Urgent	CVE-2026-117962	firefox-esr: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component	9.6	0.0039	None reported
Urgent	CVE-2026-117988	firefox-esr: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component	9.6	0.0039	None reported
Urgent	CVE-2026-117990	firefox-esr: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component	9.6	0.0039	None reported
Urgent	CVE-2026-117920	firefox-esr: Use-after-free in the DOM: HTML Parser component	9.6	0.0038	None reported
Urgent	CVE-2026-117985	firefox-esr: Sandbox escape due to use-after-free in the Graphics component	9.6	0.0038	None reported
Urgent	CVE-2026-117997	firefox-esr: Sandbox escape due to use-after-free in the Widget component	9.6	0.0038	None reported
High	CVE-2026-117925	firefox-esr: Use-after-free in the DOM: Core & HTML component	8.8	0.0043	None reported
High	CVE-2026-117967	firefox-esr: Mitigation bypass in the DOM: Security component	8.8	0.0041	None reported
High	CVE-2026-117998	firefox-esr: Mitigation bypass in the DOM: Push Subscriptions component	8.8	0.0041	None reported
High	CVE-2026-117950	firefox-esr: Incorrect boundary conditions in the DOM: Core & HTML component	8.8	0.0041	None reported
High	CVE-2026-117979	firefox-esr: Incorrect boundary conditions in the Graphics: WebRender component	8.8	0.0041	None reported
High	CVE-2026-117869	firefox-esr: Use-after-free in the DOM: Core & HTML component	8.8	0.0040	None reported
High	CVE-2026-117872	firefox-esr: Use-after-free in the JavaScript: Standard Library component	8.8	0.0040	None reported
High	CVE-2026-117881	firefox-esr: Use-after-free in the DOM: Core & HTML component	8.8	0.0040	None reported
High	CVE-2026-117883	firefox-esr: Use-after-free in the DOM: HTML Parser component	8.8	0.0040	None reported

Also fixes CVE-2026-117946

ELSA-2026-93956
firefox on ol 10
ELSA-2026-93957
firefox, firefox-x11 on ol 9
DEBIAN-CVE-2026-117946
firefox-esr, thunderbird on Debian 12.15 (bookworm), Debian 13.5 (trixie)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2026-94405.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/elsa-2026-94405">ELSA-2026-94405 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.