Critical Security Update for Firefox: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:7672: Important: firefox security update. Affects firefox versions < 140.9.1-1.el10_1. Fixed in 140.9.1-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It supports a variety of web technologies and is frequently updated to enhance security and user experience. However, like any software, it can be susceptible to vulnerabilities that may compromise user data and system integrity.
Vulnerability Detail
The vulnerabilities in this update stem from issues in the libpng library and memory safety bugs within Firefox and Thunderbird. Specifically, there are risks of arbitrary code execution due to a use-after-free vulnerability (CVE-2026-33416), information disclosure and denial of service from out-of-bounds read/write operations (CVE-2026-33636), and various memory safety bugs that could lead to crashes or unauthorized access to sensitive information. These vulnerabilities can be exploited by attackers to execute malicious code or disrupt service, posing significant risks to users.
How To Fix
Minimum fixed version
140.9.1-1.el10_1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted websites or downloading unknown files until the update is applied. Additionally, users can disable JavaScript in their browser settings to mitigate the risk of exploitation.
Conclusion
In summary, the recent security update for Firefox addresses critical vulnerabilities that could lead to severe consequences if left unpatched. Users are strongly encouraged to update their browsers to the latest version to protect against potential exploits.
See every vulnerability recorded for firefox →
FAQ
The update addresses several vulnerabilities, including arbitrary code execution, information disclosure, and memory safety bugs.
You can check your Firefox version by navigating to 'Help' > 'About Firefox'. If it's older than 140.9.1-1.el10_1, you are at risk.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json.
If you cannot update right away, avoid visiting suspicious websites and consider disabling JavaScript as a temporary workaround.
For more details, refer to the CVE pages linked in the security advisory or visit the Mozilla security updates page.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
