Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Firefox ESR may crash privileged process via malicious page
published 5 days ago
Summary
The extended support version of Firefox can be forced to stop working if a web page sends specially crafted data to a component called FilterNodeD2D1. This flaw could cause the browser's high‑privilege process to crash, potentially letting an attacker disrupt a user's session. Updating Firefox ESR to the latest version or applying the vendor's patch will resolve the issue.
What to do
- Update cleanstart firefox-esr to version 115.3.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | firefox-esr |
< 115.3.0-r0 Fix: upgrade to 115.3.0-r0
|
Original advisory text
compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process
Security vulnerability affects the firefox-esr package. A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-LQ05343 · OSV
Track software like this
Free during beta