Mozilla Foundation Security Advisory 2026-126
Security Vulnerabilities fixed in Firefox ESR 115.45
- Announced
- November 10, 2026
- Impact
- high
- Products
- Firefox ESR
- Fixed in
-
- Firefox ESR 115.45
#CVE-2026-109736: Frame poisoning in the Layout component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124952: Use-after-free in the Audio/Video component
- Reporter
- andrew.kemeklis
- Impact
- high
References
#CVE-2026-124857: Use-after-free in the Graphics: Canvas2D component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124858: Use-after-free in the DOM: HTML Parser component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-124859: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124860: Use-after-free in the Audio/Video component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124861: Sandbox escape due to use-after-free in the Audio/Video: cubeb component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124863: Use-after-free in the DOM: HTML Parser component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124864: Sandbox escape due to use-after-free in the DOM: Service Workers component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124865: Use-after-free in the Audio/Video component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124872: Use-after-free in the Cycle Collector component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124874: Same-origin policy bypass in the Networking: HTTP component
- Reporter
- Minseong Kim
- Impact
- high
References
#CVE-2026-124875: Incorrect boundary conditions in the DOM: CSS Object Model component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124876: Use-after-free in the CSS Parsing and Computation component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124877: Use-after-free in the Layout: Positioned component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124880: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124881: Use-after-free in the CSS Parsing and Computation component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124882: Use-after-free in the CSS Parsing and Computation component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124885: Use-after-free in the Graphics: Text component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124890: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124895: Use-after-free in the Storage: localStorage & sessionStorage component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124898: Use-after-free in the DOM: Editor component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124899: Use-after-free in the Layout: Text and Fonts component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-124901: Other issue in the Networking: JAR component
- Reporter
- dodoh4t
- Impact
- high
References
#CVE-2026-124902: Same-origin policy bypass due to race condition in the Audio/Video component
- Reporter
- dodoh4t
- Impact
- high
References
#CVE-2026-124903: Sandbox escape due to use-after-free in the IPC component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-124905: Sandbox escape in the DOM: Navigation component
- Reporter
- Mozilla
- Impact
- high