DeutschShown in its original language — a full translation is planned for a future version.
Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen
view advisory published 2026-08-18
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Firefox ESR und Thunderbird ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Spoofing- oder Clickjacking-Angriffe durchzuführen oder Denial-of-Service-Zustände herbeizuführen.
01
describes (58)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-75874US | — | — | ||
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thu… | ||||
| CVE-2026-74990US | — | — | ||
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-rele… | ||||
| CVE-2026-74989US | — | — | ||
Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort… | ||||
| CVE-2026-74988US | — | — | ||
Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presu… | ||||
| CVE-2026-74987US | — | — | ||
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-rele… | ||||
| CVE-2026-74986US | — | — | ||
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74985US | — | — | ||
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74984US | — | — | ||
Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74983US | — | — | ||
Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, an… | ||||
| CVE-2026-74982US | — | — | ||
Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74981US | — | — | ||
Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74980US | — | — | ||
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-74979US | — | — | ||
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74978US | — | — | ||
Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74977US | — | — | ||
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74976US | — | — | ||
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14,… | ||||
| CVE-2026-74975US | — | — | ||
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-74974US | — | — | ||
Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 1… | ||||
| CVE-2026-74973US | — | — | ||
Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, T… | ||||
| CVE-2026-74972US | — | — | ||
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 14… | ||||
showing 20 of 58
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:58897 vom 2026-08-24external
- Red Hat Security Advisory RHSA-2026:58898 vom 2026-08-24external
- Red Hat Security Advisory RHSA-2026:64813 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:65103 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:65105 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:65110 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:65111 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:65158 vom 2026-09-08external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan