Critical Security Update for Firefox: Addressing Memory Safety and Information Disclosure Vulnerabilities
Summary
ALSA-2026:19157: Important: firefox security update. Affects firefox versions < 140.10.1-1.el10_2. Fixed in 140.10.1-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely used open-source web browser known for its commitment to standards compliance, performance, and portability. It supports various web technologies and is designed to provide a secure browsing experience. However, like any software, it is susceptible to vulnerabilities that can compromise user security and privacy. The recent vulnerabilities identified in Firefox highlight critical issues related to memory safety and information disclosure, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities in Firefox stem from memory safety bugs and incorrect boundary conditions in various components, including the Audio/Video and WebRTC functionalities. Specifically, CVE-2026-7320 involves information disclosure due to these boundary issues, while CVE-2026-7321 presents a sandbox escape risk. These vulnerabilities can lead to unauthorized access to sensitive information or allow malicious actors to execute arbitrary code, posing significant risks to users.
How To Fix
Minimum fixed version
140.10.1-1.el10_2
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit exposure by avoiding the use of affected features, such as WebRTC and specific audio/video functionalities, until the update is applied. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The recent vulnerabilities in Firefox highlight critical security issues that require immediate action from users. By updating to the latest versions, users can protect themselves from potential exploits. Additionally, tools like Vulert can assist in monitoring for vulnerabilities in open-source software, ensuring ongoing security.
See every vulnerability recorded for firefox →
FAQ
The update addresses memory safety bugs and information disclosure vulnerabilities in the Audio/Video and WebRTC components of Firefox.
You can check your Firefox version by going to the 'About Firefox' section in the menu. If your version is below 140.10.1 or 150.0.1, it is affected.
If you cannot update immediately, avoid using the affected features like WebRTC and audio/video functionalities until you can apply the update.
More information can be found on the CVE pages linked in the advisory, which detail the vulnerabilities and their impacts.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
