Critical Security Update for Firefox: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:20574: Important: firefox security update. Affects firefox versions < 140.10.2-1.el9_8. Fixed in 140.10.2-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It offers a range of features including tabbed browsing, privacy protection, and extensive customization options through add-ons. However, like any software, it is susceptible to vulnerabilities that can compromise user security and privacy.
Vulnerability Detail
The vulnerabilities in this update include a use-after-free issue in the DOM: Networking component (CVE-2026-8090), memory safety bugs affecting multiple versions of Firefox (CVE-2026-8092), and an issue in the WebRTC component (CVE-2026-8094). These vulnerabilities could allow attackers to execute arbitrary code, potentially leading to data breaches or unauthorized access to user information.
How To Fix
Minimum fixed version
140.10.2-1.el9_8
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable WebRTC in Firefox settings to mitigate risks associated with the vulnerabilities until the update is applied. This can be done by navigating to 'about:config' in the Firefox address bar, searching for 'media.peerconnection.enabled', and setting it to 'false'.
Conclusion
In summary, Mozilla Firefox has released a critical security update addressing multiple vulnerabilities that could potentially compromise user security. It is essential for users to update to the latest version to protect against these threats. Additionally, temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for firefox →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially allowing attackers to execute arbitrary code.
You can check your Firefox version by clicking on the menu button, selecting 'Help', and then 'About Firefox'. Compare your version with the patched version 140.10.2-1.el9_8.
If you cannot update Firefox immediately, consider disabling WebRTC as a temporary measure to reduce the risk of exploitation.
More detailed information can be found on the CVE pages for CVE-2026-8090, CVE-2026-8092, and CVE-2026-8094.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json, allowing you to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
