Critical Security Update for Firefox: Addressing Multiple Memory Safety and Information Disclosure Vulnerabilities
Summary
ALSA-2026:19588: Important: firefox security update. Affects firefox versions < 140.10.1-1.el8_10.alma.1. Fixed in 140.10.1-1.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It is designed to provide users with a secure and efficient browsing experience. However, like any software, it is susceptible to vulnerabilities that can compromise user security and privacy. This particular update addresses critical issues that could lead to memory safety bugs and information disclosure, affecting both Firefox and Thunderbird applications.
Vulnerability Detail
The vulnerabilities identified in this update include memory safety bugs and incorrect boundary conditions that could lead to information disclosure. Specifically, CVE-2026-7323 addresses memory safety issues in Firefox ESR and Thunderbird, while CVE-2026-7320 highlights information disclosure risks in the Audio/Video component. Additionally, CVE-2026-7321 points to a sandbox escape vulnerability in the WebRTC: Networking component, which could allow attackers to bypass security measures and access sensitive data.
How To Fix
Minimum fixed version
140.10.1-1.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable certain features related to WebRTC and Audio/Video components until the update is applied. This can be done by adjusting the browser settings or using privacy-focused extensions that limit these functionalities.
Conclusion
In summary, the recent security update for Firefox addresses critical vulnerabilities that could compromise user safety. It is essential for users to update their installations promptly to protect against potential exploits. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for firefox →
FAQ
The update addresses memory safety bugs and information disclosure vulnerabilities in both Firefox and Thunderbird, specifically affecting the Audio/Video and WebRTC components.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider disabling WebRTC and Audio/Video features as a temporary workaround to mitigate risks.
While specific exploits have not been publicly disclosed, the nature of the vulnerabilities suggests that they could be leveraged by attackers to compromise user security.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, which provide insights into the impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
