Critical Security Update for Firefox: Addressing Memory Safety and Information Disclosure Vulnerabilities
Summary
ALSA-2026:19370: Important: firefox security update. Affects firefox versions < 140.10.1-1.el9_8.alma.1. Fixed in 140.10.1-1.el9_8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely used open-source web browser known for its commitment to standards compliance, performance, and portability. It supports a range of features including tabbed browsing, privacy controls, and a vast library of extensions. However, like any software, it is susceptible to vulnerabilities that can compromise user security and privacy.
Vulnerability Detail
This vulnerability arises from multiple memory safety bugs and incorrect boundary conditions in the Audio/Video and WebRTC components of Firefox and Thunderbird. These issues can lead to memory corruption, information disclosure, and potential sandbox escape, allowing attackers to execute arbitrary code or access sensitive data. The vulnerabilities are tracked under CVEs: CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, and CVE-2026-7323.
How To Fix
Minimum fixed version
140.10.1-1.el9_8.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable certain features related to Audio/Video and WebRTC until the update is applied. However, this is not a permanent solution and updating the software is strongly recommended.
Conclusion
In summary, the recent security update for Firefox addresses critical vulnerabilities that could compromise user security. It is essential for users to update their software to the latest version to protect against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for firefox →
FAQ
The update addresses memory safety bugs and information disclosure vulnerabilities in the Audio/Video and WebRTC components of Firefox and Thunderbird.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling features related to Audio/Video and WebRTC as a temporary workaround.
These vulnerabilities can lead to memory corruption, information disclosure, and potential unauthorized access to sensitive data.
For more details, refer to the CVE pages linked in the advisory or the official Mozilla security updates page.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
