Release firefox-140.16.0-1.el9_8 ALSA-2026:69462

This is a release announcement for a security update. The work is already done; the issue is informational. To verify, check the AlmaLinux update repository for the firefox package versions listed. No code changes are needed.

firefox security update
Severity: Important
Description
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)
• firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)
• firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)
• firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)
• firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)
• firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)
• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)
• firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)
• firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)
• firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)
• firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)
• firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)
• firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)
• firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)
• firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)
• firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007)
• firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025)
• firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029)
• firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected packages:
firefox-140.16.0-1.el9_8.x86_64
firefox-x11-140.16.0-1.el9_8.x86_64
firefox-140.16.0-1.el9_8.s390x
firefox-x11-140.16.0-1.el9_8.s390x
firefox-140.16.0-1.el9_8.ppc64le
firefox-x11-140.16.0-1.el9_8.ppc64le
firefox-140.16.0-1.el9_8.aarch64
firefox-x11-140.16.0-1.el9_8.aarch64