An update for firefox is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4452 Final 1.0 1.0 2026-10-22 Initial 2026-10-22 2026-10-22 openEuler SA Tool V1.0 2026-10-22 firefox security update An update for firefox is now available for openEuler-24.03-LTS-SP4 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es): Sandbox escape in the Security: Process Sandboxing component of Mozilla Firefox. An attacker could exploit this vulnerability to break out of the browser's process sandbox restrictions. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100760) A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox. An attacker could exploit this vulnerability to cause memory corruption, potentially leading to a browser crash or arbitrary code execution. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100765) Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100787) Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100798) Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100800) Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100806) Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100808) Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100809) Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100812) Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100814) Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100815) Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.(CVE-2026-100816) Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100822) An improper privilege management vulnerability exists in the Places component of Mozilla Firefox. A remote attacker could escalate privileges by interacting with the affected component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100824) Use-after-free in the JavaScript Engine: JIT component of Mozilla Firefox. An attacker could exploit this vulnerability to cause memory corruption, leading to denial of service or potentially arbitrary code execution. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100825) The vulnerability allows a remote attacker to cause a denial of service. The vulnerability exists due to an unspecified flaw in the Storage: StorageManager component when the component is used. A remote attacker can interact with the affected component to cause a denial of service. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100826) Mitigation bypass in the Bookmarks & History component of Mozilla Firefox. The vulnerability exists due to improper security control enforcement in the Bookmarks & History component when the component is used, allowing a remote attacker to interact with the affected component to bypass a security mitigation. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100828) Mitigation bypass in the DOM: Security component. The vulnerability exists due to improper security control enforcement in the DOM: Security component when the component is used. A remote attacker can interact with the affected component to bypass a security mitigation. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100829) Mitigation bypass in the DOM: Navigation component. The vulnerability exists due to improper security control enforcement, allowing a remote attacker to interact with the affected component to bypass a security mitigation. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100830) Use-after-free in the DOM: UI Events & Focus Handling component of Mozilla Firefox. This vulnerability could allow an attacker to cause memory corruption, potentially leading to a browser crash or arbitrary code execution. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.(CVE-2026-100831) Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109704) Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109705) Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109706) Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109707) Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109708) Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109709) Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109710) Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109711) Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109712) Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109713) Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109715) Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109716) Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109717) Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109718) Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109719) JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109720) Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109721) JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109722) Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109723) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109724) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109725) Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109726) Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109727) Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109728) Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109729) Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109730) Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109731) Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.(CVE-2026-109732) JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109733) Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109734) Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109736) Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109737) Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109738) Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109740) Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109741) Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109742) Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109743) Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109744) Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109745) Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109751) Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109752) Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109753) Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109754) Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109756) Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109757) Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109759) Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109760) Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109762) Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109763) Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109764) Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109765) Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109766) Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109767) Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109770) Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109775) Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.(CVE-2026-109776) Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109777) Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109778) Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.(CVE-2026-109781) Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.(CVE-2026-109782) Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.(CVE-2026-109783) An update for firefox is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical firefox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100760 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100765 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100787 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100798 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100800 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100806 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100808 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100809 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100812 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100814 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100815 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100816 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100822 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100824 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100825 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100826 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100828 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100829 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100830 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-100831 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109704 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109705 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109706 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109707 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109708 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109709 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109710 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109711 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109712 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109713 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109715 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109716 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109717 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109718 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109719 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109720 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109721 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109722 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109723 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109724 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109725 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109726 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109727 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109728 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109729 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109730 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109731 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109732 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109733 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109734 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109736 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109737 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109738 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109740 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109741 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109742 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109743 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109744 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109745 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109751 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109752 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109753 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109754 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109756 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109757 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109759 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109760 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109762 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109763 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109764 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109765 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109766 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109767 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109770 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109775 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109776 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109777 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109778 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109781 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109782 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109783 https://nvd.nist.gov/vuln/detail/CVE-2026-100760 https://nvd.nist.gov/vuln/detail/CVE-2026-100765 https://nvd.nist.gov/vuln/detail/CVE-2026-100787 https://nvd.nist.gov/vuln/detail/CVE-2026-100798 https://nvd.nist.gov/vuln/detail/CVE-2026-100800 https://nvd.nist.gov/vuln/detail/CVE-2026-100806 https://nvd.nist.gov/vuln/detail/CVE-2026-100808 https://nvd.nist.gov/vuln/detail/CVE-2026-100809 https://nvd.nist.gov/vuln/detail/CVE-2026-100812 https://nvd.nist.gov/vuln/detail/CVE-2026-100814 https://nvd.nist.gov/vuln/detail/CVE-2026-100815 https://nvd.nist.gov/vuln/detail/CVE-2026-100816 https://nvd.nist.gov/vuln/detail/CVE-2026-100822 https://nvd.nist.gov/vuln/detail/CVE-2026-100824 https://nvd.nist.gov/vuln/detail/CVE-2026-100825 https://nvd.nist.gov/vuln/detail/CVE-2026-100826 https://nvd.nist.gov/vuln/detail/CVE-2026-100828 https://nvd.nist.gov/vuln/detail/CVE-2026-100829 https://nvd.nist.gov/vuln/detail/CVE-2026-100830 https://nvd.nist.gov/vuln/detail/CVE-2026-100831 https://nvd.nist.gov/vuln/detail/CVE-2026-109704 https://nvd.nist.gov/vuln/detail/CVE-2026-109705 https://nvd.nist.gov/vuln/detail/CVE-2026-109706 https://nvd.nist.gov/vuln/detail/CVE-2026-109707 https://nvd.nist.gov/vuln/detail/CVE-2026-109708 https://nvd.nist.gov/vuln/detail/CVE-2026-109709 https://nvd.nist.gov/vuln/detail/CVE-2026-109710 https://nvd.nist.gov/vuln/detail/CVE-2026-109711 https://nvd.nist.gov/vuln/detail/CVE-2026-109712 https://nvd.nist.gov/vuln/detail/CVE-2026-109713 https://nvd.nist.gov/vuln/detail/CVE-2026-109715 https://nvd.nist.gov/vuln/detail/CVE-2026-109716 https://nvd.nist.gov/vuln/detail/CVE-2026-109717 https://nvd.nist.gov/vuln/detail/CVE-2026-109718 https://nvd.nist.gov/vuln/detail/CVE-2026-109719 https://nvd.nist.gov/vuln/detail/CVE-2026-109720 https://nvd.nist.gov/vuln/detail/CVE-2026-109721 https://nvd.nist.gov/vuln/detail/CVE-2026-109722 https://nvd.nist.gov/vuln/detail/CVE-2026-109723 https://nvd.nist.gov/vuln/detail/CVE-2026-109724 https://nvd.nist.gov/vuln/detail/CVE-2026-109725 https://nvd.nist.gov/vuln/detail/CVE-2026-109726 https://nvd.nist.gov/vuln/detail/CVE-2026-109727 https://nvd.nist.gov/vuln/detail/CVE-2026-109728 https://nvd.nist.gov/vuln/detail/CVE-2026-109729 https://nvd.nist.gov/vuln/detail/CVE-2026-109730 https://nvd.nist.gov/vuln/detail/CVE-2026-109731 https://nvd.nist.gov/vuln/detail/CVE-2026-109732 https://nvd.nist.gov/vuln/detail/CVE-2026-109733 https://nvd.nist.gov/vuln/detail/CVE-2026-109734 https://nvd.nist.gov/vuln/detail/CVE-2026-109736 https://nvd.nist.gov/vuln/detail/CVE-2026-109737 https://nvd.nist.gov/vuln/detail/CVE-2026-109738 https://nvd.nist.gov/vuln/detail/CVE-2026-109740 https://nvd.nist.gov/vuln/detail/CVE-2026-109741 https://nvd.nist.gov/vuln/detail/CVE-2026-109742 https://nvd.nist.gov/vuln/detail/CVE-2026-109743 https://nvd.nist.gov/vuln/detail/CVE-2026-109744 https://nvd.nist.gov/vuln/detail/CVE-2026-109745 https://nvd.nist.gov/vuln/detail/CVE-2026-109751 https://nvd.nist.gov/vuln/detail/CVE-2026-109752 https://nvd.nist.gov/vuln/detail/CVE-2026-109753 https://nvd.nist.gov/vuln/detail/CVE-2026-109754 https://nvd.nist.gov/vuln/detail/CVE-2026-109756 https://nvd.nist.gov/vuln/detail/CVE-2026-109757 https://nvd.nist.gov/vuln/detail/CVE-2026-109759 https://nvd.nist.gov/vuln/detail/CVE-2026-109760 https://nvd.nist.gov/vuln/detail/CVE-2026-109762 https://nvd.nist.gov/vuln/detail/CVE-2026-109763 https://nvd.nist.gov/vuln/detail/CVE-2026-109764 https://nvd.nist.gov/vuln/detail/CVE-2026-109765 https://nvd.nist.gov/vuln/detail/CVE-2026-109766 https://nvd.nist.gov/vuln/detail/CVE-2026-109767 https://nvd.nist.gov/vuln/detail/CVE-2026-109770 https://nvd.nist.gov/vuln/detail/CVE-2026-109775 https://nvd.nist.gov/vuln/detail/CVE-2026-109776 https://nvd.nist.gov/vuln/detail/CVE-2026-109777 https://nvd.nist.gov/vuln/detail/CVE-2026-109778 https://nvd.nist.gov/vuln/detail/CVE-2026-109781 https://nvd.nist.gov/vuln/detail/CVE-2026-109782 https://nvd.nist.gov/vuln/detail/CVE-2026-109783 openEuler-24.03-LTS-SP4 firefox-153.5.0-1.oe2403sp4.aarch64.rpm firefox-debuginfo-153.5.0-1.oe2403sp4.aarch64.rpm firefox-debugsource-153.5.0-1.oe2403sp4.aarch64.rpm firefox-153.5.0-1.oe2403sp4.src.rpm firefox-153.5.0-1.oe2403sp4.x86_64.rpm firefox-debuginfo-153.5.0-1.oe2403sp4.x86_64.rpm firefox-debugsource-153.5.0-1.oe2403sp4.x86_64.rpm Sandbox escape in the Security: Process Sandboxing component of Mozilla Firefox. An attacker could exploit this vulnerability to break out of the browser's process sandbox restrictions. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100760 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox. An attacker could exploit this vulnerability to cause memory corruption, potentially leading to a browser crash or arbitrary code execution. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100765 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100787 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100798 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100800 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100806 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100808 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100809 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100812 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100814 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100815 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. 2026-10-22 CVE-2026-100816 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100822 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 An improper privilege management vulnerability exists in the Places component of Mozilla Firefox. A remote attacker could escalate privileges by interacting with the affected component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100824 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the JavaScript Engine: JIT component of Mozilla Firefox. An attacker could exploit this vulnerability to cause memory corruption, leading to denial of service or potentially arbitrary code execution. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100825 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 The vulnerability allows a remote attacker to cause a denial of service. The vulnerability exists due to an unspecified flaw in the Storage: StorageManager component when the component is used. A remote attacker can interact with the affected component to cause a denial of service. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100826 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the Bookmarks & History component of Mozilla Firefox. The vulnerability exists due to improper security control enforcement in the Bookmarks & History component when the component is used, allowing a remote attacker to interact with the affected component to bypass a security mitigation. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100828 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the DOM: Security component. The vulnerability exists due to improper security control enforcement in the DOM: Security component when the component is used. A remote attacker can interact with the affected component to bypass a security mitigation. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100829 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the DOM: Navigation component. The vulnerability exists due to improper security control enforcement, allowing a remote attacker to interact with the affected component to bypass a security mitigation. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100830 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the DOM: UI Events & Focus Handling component of Mozilla Firefox. This vulnerability could allow an attacker to cause memory corruption, potentially leading to a browser crash or arbitrary code execution. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. 2026-10-22 CVE-2026-100831 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109704 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109705 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109706 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109707 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109708 openEuler-24.03-LTS-SP4 Critical 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109709 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109710 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109711 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109712 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109713 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109715 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109716 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109717 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109718 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109719 openEuler-24.03-LTS-SP4 Medium 4.2 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109720 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109721 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109722 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109723 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109724 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109725 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109726 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109727 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109728 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109729 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109730 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109731 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. 2026-10-22 CVE-2026-109732 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109733 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109734 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109736 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109737 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109738 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109740 openEuler-24.03-LTS-SP4 Critical 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109741 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109742 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109743 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109744 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109745 openEuler-24.03-LTS-SP4 Critical 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109751 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109752 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109753 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109754 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109756 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109757 openEuler-24.03-LTS-SP4 Critical 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109759 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109760 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109762 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109763 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109764 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109765 openEuler-24.03-LTS-SP4 Medium 4.2 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109766 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109767 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109770 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109775 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. 2026-10-22 CVE-2026-109776 openEuler-24.03-LTS-SP4 High 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109777 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109778 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. 2026-10-22 CVE-2026-109781 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. 2026-10-22 CVE-2026-109782 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. 2026-10-22 CVE-2026-109783 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4452