An update for firefox is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3556 Final 1.0 1.0 2026-08-30 Initial 2026-08-30 2026-08-30 openEuler SA Tool V1.0 2026-08-30 firefox security update An update for firefox is now available for openEuler-22.03-LTS-SP4 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo Security Fix(es): Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74934) A privilege escalation vulnerability exists in Mozilla Firefox and Thunderbird in the DOM: Networking component. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. An attacker could exploit this vulnerability to affect confidentiality, integrity, and availability. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74935) Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74936) Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74939) Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74940) Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This has an impact on confidentiality, integrity, and availability.(CVE-2026-74941) Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74942) Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74943) Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74944) Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74945) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74946) Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74948) Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74949) Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74953) Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74957) Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74959) Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74960) Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74962) Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74963) Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74964) Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74965) Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74967) Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74969) Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74971) Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74972) Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74973) Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74974) JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74976) Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74983) Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74987) Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.(CVE-2026-74990) An update for firefox is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical firefox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74934 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74935 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74936 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74939 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74940 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74941 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74942 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74943 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74944 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74945 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74946 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74948 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74949 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74953 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74957 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74959 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74960 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74962 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74963 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74964 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74965 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74967 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74969 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74971 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74972 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74973 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74974 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74976 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74983 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74987 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-74990 https://nvd.nist.gov/vuln/detail/CVE-2026-74934 https://nvd.nist.gov/vuln/detail/CVE-2026-74935 https://nvd.nist.gov/vuln/detail/CVE-2026-74936 https://nvd.nist.gov/vuln/detail/CVE-2026-74939 https://nvd.nist.gov/vuln/detail/CVE-2026-74940 https://nvd.nist.gov/vuln/detail/CVE-2026-74941 https://nvd.nist.gov/vuln/detail/CVE-2026-74942 https://nvd.nist.gov/vuln/detail/CVE-2026-74943 https://nvd.nist.gov/vuln/detail/CVE-2026-74944 https://nvd.nist.gov/vuln/detail/CVE-2026-74945 https://nvd.nist.gov/vuln/detail/CVE-2026-74946 https://nvd.nist.gov/vuln/detail/CVE-2026-74948 https://nvd.nist.gov/vuln/detail/CVE-2026-74949 https://nvd.nist.gov/vuln/detail/CVE-2026-74953 https://nvd.nist.gov/vuln/detail/CVE-2026-74957 https://nvd.nist.gov/vuln/detail/CVE-2026-74959 https://nvd.nist.gov/vuln/detail/CVE-2026-74960 https://nvd.nist.gov/vuln/detail/CVE-2026-74962 https://nvd.nist.gov/vuln/detail/CVE-2026-74963 https://nvd.nist.gov/vuln/detail/CVE-2026-74964 https://nvd.nist.gov/vuln/detail/CVE-2026-74965 https://nvd.nist.gov/vuln/detail/CVE-2026-74967 https://nvd.nist.gov/vuln/detail/CVE-2026-74969 https://nvd.nist.gov/vuln/detail/CVE-2026-74971 https://nvd.nist.gov/vuln/detail/CVE-2026-74972 https://nvd.nist.gov/vuln/detail/CVE-2026-74973 https://nvd.nist.gov/vuln/detail/CVE-2026-74974 https://nvd.nist.gov/vuln/detail/CVE-2026-74976 https://nvd.nist.gov/vuln/detail/CVE-2026-74983 https://nvd.nist.gov/vuln/detail/CVE-2026-74987 https://nvd.nist.gov/vuln/detail/CVE-2026-74990 openEuler-22.03-LTS-SP4 firefox-140.14.0-1.oe2203sp4.src.rpm firefox-140.14.0-1.oe2203sp4.x86_64.rpm firefox-debuginfo-140.14.0-1.oe2203sp4.x86_64.rpm firefox-debugsource-140.14.0-1.oe2203sp4.x86_64.rpm firefox-140.14.0-1.oe2203sp4.aarch64.rpm firefox-debuginfo-140.14.0-1.oe2203sp4.aarch64.rpm firefox-debugsource-140.14.0-1.oe2203sp4.aarch64.rpm Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74934 openEuler-22.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 A privilege escalation vulnerability exists in Mozilla Firefox and Thunderbird in the DOM: Networking component. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. An attacker could exploit this vulnerability to affect confidentiality, integrity, and availability. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74935 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74936 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74939 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74940 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This has an impact on confidentiality, integrity, and availability. 2026-08-30 CVE-2026-74941 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74942 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74943 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74944 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74945 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74946 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74948 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74949 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74953 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74957 openEuler-22.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74959 openEuler-22.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74960 openEuler-22.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74962 openEuler-22.03-LTS-SP4 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74963 openEuler-22.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74964 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74965 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74967 openEuler-22.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74969 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74971 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74972 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74973 openEuler-22.03-LTS-SP4 Medium 4.2 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74974 openEuler-22.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74976 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74983 openEuler-22.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74987 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556 Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. 2026-08-30 CVE-2026-74990 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3556