ALAS2023-2026-3214

References: CVE-2026-100756  CVE-2026-100757  CVE-2026-100758  CVE-2026-100759  CVE-2026-100760  CVE-2026-100762  CVE-2026-100765  CVE-2026-100767  CVE-2026-100769  CVE-2026-100770  CVE-2026-100771  CVE-2026-100772  CVE-2026-100773  CVE-2026-100774  CVE-2026-100775  CVE-2026-100776  CVE-2026-100777  CVE-2026-100778  CVE-2026-100779  CVE-2026-100780  CVE-2026-100781  CVE-2026-100782  CVE-2026-100783  CVE-2026-100784  CVE-2026-100785  CVE-2026-100786  CVE-2026-100788  CVE-2026-100789  CVE-2026-100790  CVE-2026-100791  CVE-2026-100792  CVE-2026-100794  CVE-2026-100797  CVE-2026-100798  CVE-2026-100801  CVE-2026-100803  CVE-2026-100806  CVE-2026-100807  CVE-2026-100808  CVE-2026-100809  CVE-2026-100811  CVE-2026-100812  CVE-2026-100814  CVE-2026-100815  CVE-2026-100816  CVE-2026-100818  CVE-2026-100819  CVE-2026-100820  CVE-2026-100821  CVE-2026-100822  CVE-2026-100824  CVE-2026-100825  CVE-2026-100826  CVE-2026-100828  CVE-2026-100829  CVE-2026-100830  CVE-2026-100831  CVE-2026-100832  CVE-2026-102633  CVE-2026-84129  CVE-2026-84132  CVE-2026-84133  CVE-2026-84136  CVE-2026-84137  CVE-2026-84140  CVE-2026-84141  CVE-2026-91733  CVE-2026-92005  CVE-2026-92006  CVE-2026-92007  CVE-2026-92008  CVE-2026-92009  CVE-2026-92010  CVE-2026-92011  CVE-2026-92012  CVE-2026-92013  CVE-2026-92014  CVE-2026-92015  CVE-2026-92016  CVE-2026-92017  CVE-2026-92018  CVE-2026-92019  CVE-2026-92020  CVE-2026-92021  CVE-2026-92022  CVE-2026-92023  CVE-2026-92024  CVE-2026-92025  CVE-2026-92026  CVE-2026-92027  CVE-2026-92028  CVE-2026-92029  CVE-2026-92030  CVE-2026-92031  CVE-2026-92032  CVE-2026-92035  CVE-2026-92038  CVE-2026-92039  CVE-2026-92041  CVE-2026-92042  CVE-2026-92043  CVE-2026-92044  CVE-2026-92045  CVE-2026-92046  CVE-2026-92047  CVE-2026-92052  CVE-2026-92053  CVE-2026-92054  CVE-2026-92055  CVE-2026-92056  CVE-2026-92057  CVE-2026-92058  CVE-2026-92059  CVE-2026-92060  CVE-2026-92062  CVE-2026-92067  CVE-2026-92068  CVE-2026-92069  CVE-2026-92070  CVE-2026-92072  CVE-2026-92073  CVE-2026-92074  CVE-2026-92075  CVE-2026-92076  CVE-2026-92078  CVE-2026-93749  CVE-2026-93990  CVE-2026-96869 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100759)

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100760)

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100762)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100765)

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100767)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100769)

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100770)

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100771)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100772)

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100773)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100774)

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100775)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100776)

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100777)

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100778)

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100779)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100780)

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100781)

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100782)

Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100783)

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100784)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100785)

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100786)

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100788)

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100789)

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100790)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100791)

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100792)

Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100794)

Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100797)

Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100798)

Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100801)

Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100803)

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100806)

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100807)

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100808)

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100809)

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100811)

Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100812)

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100814)

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100815)

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100816)

Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100818)

Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-100820)

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100821)

Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100822)

Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100824)

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100825)

Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100826)

Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100828)

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100829)

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100830)

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100831)

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100832)

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service. (CVE-2026-102633)

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84129)

Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84132)

Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84133)

Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84136)

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84137)

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84140)

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. (CVE-2026-84141)

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) (CVE-2026-91733)

Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92005)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92006)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92007)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92008)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92009)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92010)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92011)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92012)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92013)

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16. (CVE-2026-92014)

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92015)

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92016)

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92017)

Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92018)

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92019)

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92020)

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. (CVE-2026-92021)

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92022)

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92023)

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92024)

Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92025)

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92026)

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92027)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92028)

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92029)

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92030)

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92031)

Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. (CVE-2026-92032)

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92035)

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92038)

Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92039)

Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92041)

Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92042)

Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92043)

Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92044)

Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92045)

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92046)

Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92047)

Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92052)

Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92053)

Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92054)

Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92055)

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92056)

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92057)

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92058)

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92059)

Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92060)

Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92062)

Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92067)

Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92068)

Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92069)

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92070)

Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92072)

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92073)

Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92074)

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92075)

Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92076)

Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. (CVE-2026-92078)

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests. (CVE-2026-93749)

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks. (CVE-2026-93990)

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. (CVE-2026-96869)

Issue Correction:
Run dnf update firefox --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3214 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    firefox-debuginfo-140.17.0-1.amzn2023.0.1.aarch64
    firefox-140.17.0-1.amzn2023.0.1.aarch64
    firefox-debugsource-140.17.0-1.amzn2023.0.1.aarch64

src:
    firefox-140.17.0-1.amzn2023.0.1.src

x86_64:
    firefox-debuginfo-140.17.0-1.amzn2023.0.1.x86_64
    firefox-140.17.0-1.amzn2023.0.1.x86_64
    firefox-debugsource-140.17.0-1.amzn2023.0.1.x86_64