Description
Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface.
Below is a complete list of vulnerabilities:
- Security vulnerability in the DOM: Navigation component can be exploited to bypass security restrictions.
- Denial of service vulnerability in the Networking component can be exploited remotely to cause denial of service.
- Information disclosure vulnerability in the Audio/Video component can be exploited to obtain sensitive information.
- Security vulnerability in the Form Manager component can be exploited to bypass security restrictions.
- A remote code execution vulnerability in the JavaScript: GC component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Graphics: Canvas2D component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Layout component can be exploited remotely to execute arbitrary code.
- Security vulnerability in the DOM: Networking component can be exploited to bypass security restrictions.
- A remote code execution vulnerability in the DOM: Core & HTML component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the JavaScript Engine component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Graphics component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the JavaScript: Standard Library component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Audio/Video: Playback component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the Internationalization component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Layout: Scrolling and Overflow component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Layout: Text and Fonts component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Storage: IndexedDB component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Layout: Tables component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the XML component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the DOM: HTML Parser component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Networking component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Layout: Grid component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Graphics: Text component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the Graphics: Canvas2D component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the JavaScript Engine component can be exploited remotely to cause denial of service.
- Security vulnerability can be exploited to bypass security restrictions.
- A remote code execution vulnerability in the JavaScript Engine: JIT component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the WebRTC: Networking component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Security: PSM component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the WebRTC: Signaling component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the Networking: HTTP component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the DOM: Editor component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Audio/Video component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Audio/Video: Playback component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the CSS Parsing and Computation component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Graphics: ImageLib component can be exploited remotely to execute arbitrary code.
- Security vulnerability in the CSS Parsing and Computation component can be exploited to bypass security restrictions.
- A remote code execution vulnerability in the SVG component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Layout: Block and Inline component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the XSLT component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Graphics: WebRender component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the Networking: WebSockets component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the SVG component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the DOM: Bindings (WebIDL) component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the DOM: Events component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the DOM: CSS Object Model component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the JavaScript Engine: JIT component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the XML component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the DOM: Core & HTML component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the Layout: Positioned component can be exploited remotely to execute arbitrary code.
- Security vulnerability in the DLL Services component can be exploited to bypass security restrictions.
- Denial of service vulnerability in the Nimbus Desktop Client component can be exploited remotely to cause denial of service.
- Security UI vulnerability in the DOM: Core & HTML component can be exploited to spoof user interface.
- Denial of service vulnerability in the Layout: Text and Fonts component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the Storage: Quota Manager component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the DOM: Service Workers component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the Panning and Zooming component can be exploited remotely to execute arbitrary code.
- Security vulnerability in the Address Bar component can be exploited to bypass security restrictions.
- Security vulnerability in the DOM: Security component can be exploited to bypass security restrictions.
- A remote code execution vulnerability in the Disability Access APIs component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Print Preview component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Graphics component can be exploited remotely to execute arbitrary code.
- A remote code execution vulnerability in the Networking: DNS component can be exploited remotely to execute arbitrary code.
- Denial of service vulnerability in the Console component can be exploited remotely to cause denial of service.
- Security vulnerability in the Toolkit component can be exploited to bypass security restrictions.
- Denial of service vulnerability in the Layout: Scrolling and Overflow component can be exploited remotely to cause denial of service.
- Denial of service vulnerability in the Graphics: CanvasWebGL component can be exploited remotely to cause denial of service.
- Information disclosure vulnerability in the CSS Parsing and Computation component can be exploited to obtain sensitive information.
- A remote code execution vulnerability in the Graphics: Text component can be exploited remotely to execute arbitrary code.
- Security vulnerability in the DOM: UI Events & Focus Handling component can be exploited to bypass security restrictions.
- Denial of service vulnerability in the WebRTC component can be exploited remotely to cause denial of service.
- A remote code execution vulnerability in the Widget component can be exploited remotely to execute arbitrary code.
- Security vulnerability in the DOM: Push Subscriptions component can be exploited to bypass security restrictions.
- A remote code execution vulnerability in the IPC component can be exploited remotely to execute arbitrary code.
- Information disclosure vulnerability in the Networking: HTTP component can be exploited to obtain sensitive information.
- Information disclosure vulnerability in the Networking: DNS component can be exploited to obtain sensitive information.
- Denial of service vulnerability in the CSS Transitions and Animations component can be exploited remotely to cause denial of service.
Original advisories
Exploitation
Related products
CVE list
- CVE-2026-100801 critical
- CVE-2026-117860 unknown
- CVE-2026-117861 unknown
- CVE-2026-117862 unknown
- CVE-2026-117863 unknown
- CVE-2026-117864 unknown
- CVE-2026-117865 unknown
- CVE-2026-117866 unknown
- CVE-2026-117867 unknown
- CVE-2026-117868 unknown
- CVE-2026-117869 unknown
- CVE-2026-117870 unknown
- CVE-2026-117871 unknown
- CVE-2026-117872 unknown
- CVE-2026-117873 unknown
- CVE-2026-117874 unknown
- CVE-2026-117875 unknown
- CVE-2026-117876 unknown
- CVE-2026-117877 unknown
- CVE-2026-117878 unknown
- CVE-2026-117879 unknown
- CVE-2026-117880 unknown
- CVE-2026-117881 unknown
- CVE-2026-117882 unknown
- CVE-2026-117883 unknown
- CVE-2026-117884 unknown
- CVE-2026-117885 unknown
- CVE-2026-117886 unknown
- CVE-2026-117887 unknown
- CVE-2026-117888 unknown
- CVE-2026-117889 unknown
- CVE-2026-117890 unknown
- CVE-2026-117891 unknown
- CVE-2026-117892 unknown
- CVE-2026-117893 unknown
- CVE-2026-117894 unknown
- CVE-2026-117895 unknown
- CVE-2026-117896 unknown
- CVE-2026-117897 unknown
- CVE-2026-117898 unknown
- CVE-2026-117899 unknown
- CVE-2026-117900 unknown
- CVE-2026-117901 unknown
- CVE-2026-117902 unknown
- CVE-2026-117903 unknown
- CVE-2026-117904 unknown
- CVE-2026-117905 unknown
- CVE-2026-117906 unknown
- CVE-2026-117907 unknown
- CVE-2026-117908 unknown
- CVE-2026-117909 unknown
- CVE-2026-117910 unknown
- CVE-2026-117911 unknown
- CVE-2026-117912 unknown
- CVE-2026-117913 unknown
- CVE-2026-117914 unknown
- CVE-2026-117915 unknown
- CVE-2026-117916 unknown
- CVE-2026-117917 unknown
- CVE-2026-117918 unknown
- CVE-2026-117919 unknown
- CVE-2026-117920 unknown
- CVE-2026-117921 unknown
- CVE-2026-117922 unknown
- CVE-2026-117923 unknown
- CVE-2026-117924 unknown
- CVE-2026-117925 unknown
- CVE-2026-117926 unknown
- CVE-2026-117927 unknown
- CVE-2026-117928 unknown
- CVE-2026-117929 unknown
- CVE-2026-117930 unknown
- CVE-2026-117931 unknown
- CVE-2026-117932 unknown
- CVE-2026-117933 unknown
- CVE-2026-117934 unknown
- CVE-2026-117935 unknown
- CVE-2026-117936 unknown
- CVE-2026-117937 unknown
- CVE-2026-117938 unknown
- CVE-2026-117939 unknown
- CVE-2026-117940 unknown
- CVE-2026-117941 unknown
- CVE-2026-117942 unknown
- CVE-2026-117943 unknown
- CVE-2026-117944 unknown
- CVE-2026-117945 unknown
- CVE-2026-117946 unknown
- CVE-2026-117947 unknown
- CVE-2026-117948 unknown
- CVE-2026-117949 unknown
- CVE-2026-117950 unknown
- CVE-2026-117951 unknown
- CVE-2026-117952 unknown
- CVE-2026-117953 unknown
- CVE-2026-117954 unknown
- CVE-2026-117955 unknown
- CVE-2026-117956 unknown
- CVE-2026-117957 unknown
- CVE-2026-117958 unknown
- CVE-2026-117959 unknown
- CVE-2026-117960 unknown
- CVE-2026-117961 unknown
- CVE-2026-117962 unknown
- CVE-2026-117963 unknown
- CVE-2026-117964 unknown
- CVE-2026-117965 unknown
- CVE-2026-117966 unknown
- CVE-2026-117967 unknown
- CVE-2026-117968 unknown
- CVE-2026-117969 unknown
- CVE-2026-117970 unknown
- CVE-2026-117971 unknown
- CVE-2026-117972 unknown
- CVE-2026-117973 unknown
- CVE-2026-117974 unknown
- CVE-2026-117975 unknown
- CVE-2026-117976 unknown
- CVE-2026-117977 unknown
- CVE-2026-117978 unknown
- CVE-2026-117979 unknown
- CVE-2026-117980 unknown
- CVE-2026-117981 unknown
- CVE-2026-117982 unknown
- CVE-2026-117983 unknown
- CVE-2026-117984 unknown
- CVE-2026-117985 unknown
- CVE-2026-117986 unknown
- CVE-2026-117987 unknown
- CVE-2026-117988 unknown
- CVE-2026-117989 unknown
- CVE-2026-117990 unknown
- CVE-2026-117991 unknown
- CVE-2026-117992 unknown
- CVE-2026-117993 unknown
- CVE-2026-117994 unknown
- CVE-2026-117995 unknown
- CVE-2026-117996 unknown
- CVE-2026-117997 unknown
- CVE-2026-117998 unknown
- CVE-2026-117999 unknown
- CVE-2026-118000 unknown
- CVE-2026-118002 unknown
- CVE-2026-118003 unknown
- CVE-2026-118004 unknown
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com
Found an inaccuracy in the description of this vulnerability? Let us know!