Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Firefox could let attackers run code or see data
published 9 months ago
Summary
Multiple problems in Firefox could let a malicious web page execute code, access private information, or trick users into unintended actions. These issues affect the Firefox browser on AlmaLinux and could be exploited if the software is not updated. Install the latest Firefox update as soon as possible to protect your users and data.
What to do
- Update almalinux firefox to version 140.7.0-1.el8_10.alma.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | firefox |
< 140.7.0-1.el8_10.alma.1 Fix: upgrade to 140.7.0-1.el8_10.alma.1
|
Original advisory text
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)
* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878)
* firefox: Use-after-free in the IPC component (CVE-2026-0882)
* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)
* firefox: Information disclosure in the Networking component (CVE-2026-0883)
* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)
* firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)
* firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)
* firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)
* firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)
* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878)
* firefox: Use-after-free in the IPC component (CVE-2026-0882)
* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)
* firefox: Information disclosure in the Networking component (CVE-2026-0883)
* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)
* firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)
* firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)
* firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)
* firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:0667 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-14327 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0877 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0878 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0879 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0880 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0882 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0883 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0884 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0885 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0886 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0887 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0890 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0891 Third Party Advisory
- https://bugzilla.redhat.com/2420507 Third Party Advisory
- https://bugzilla.redhat.com/2428961 Third Party Advisory
- https://bugzilla.redhat.com/2428963 Third Party Advisory
- https://bugzilla.redhat.com/2428965 Third Party Advisory
- https://bugzilla.redhat.com/2428966 Third Party Advisory
- https://bugzilla.redhat.com/2428967 Third Party Advisory
- https://bugzilla.redhat.com/2428968 Third Party Advisory
- https://bugzilla.redhat.com/2428969 Third Party Advisory
- https://bugzilla.redhat.com/2428971 Third Party Advisory
- https://bugzilla.redhat.com/2428972 Third Party Advisory
- https://bugzilla.redhat.com/2428973 Third Party Advisory
- https://bugzilla.redhat.com/2428975 Third Party Advisory
- https://bugzilla.redhat.com/2428978 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-0667.html Vendor Advisory
Timeline
Published15 Jan 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:0667 · OSV
Track software like this
Free during beta