Mozilla Foundation Security Advisory 2026-83

Security Vulnerabilities fixed in Firefox ESR 115.40

Announced
September 1, 2026
Impact
high
Products
Firefox ESR
Fixed in
  • Firefox ESR 115.40

#CVE-2026-75874: Sandbox escape in the Remote Settings Client component

Reporter
crixer
Impact
high
References

#CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component

Reporter
Yaqoub Aldurayhim
Impact
high
References

#CVE-2026-84120: Use-after-free in the Audio/Video component

Reporter
Ukyo Akai
Impact
high
References

#CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component

Reporter
Yaqoub Aldurayhim
Impact
high
References

#CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component

Reporter
navapon
Impact
moderate
References

#CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

Reporter
Leo Tenenbaum, Tom Ritter and the Mozilla Fuzzing Team
Impact
high
Description

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.

References