Описание
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model (DOM) Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code outside the browser's restricted sandbox environment.
Отчет
An IMPORTANT severity use-after-free flaw was found in the Firefox web browser's Document Object Model (DOM) Core and HTML component. A remote attacker could entice a victim to visit a specially crafted web page to trigger the use-after-free condition and execute arbitrary code outside of the browser's restricted sandbox environment, resulting in a sandbox escape and potential compromise of the victim's user session. The firefox component as shipped in affected Red Hat product streams is affected by this flaw; no affected Red Hat product stream is currently distinguished as not affected. Red Hat Product Security has rated this flaw with a CVSS 3.1 score of 6.1 (moderate) (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which is substantially lower than the 9.6 (critical) score assigned by CISA; the difference is mainly attributable to Red Hat's lower confidentiality and integrity impact assessment (C:L/I:L/A:N versus C:H/I:H/A:H).
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rhel10/firefox-flatpak | Affected | ||
| Red Hat Enterprise Linux 10 | rhel10/thunderbird-flatpak | Affected | ||
| Red Hat Enterprise Linux 6 | firefox | Out of support scope | ||
| Red Hat Enterprise Linux 6 | thunderbird | Out of support scope | ||
| Red Hat Enterprise Linux 7 | thunderbird | Out of support scope | ||
| Red Hat Enterprise Linux 10 | firefox | Fixed | RHSA-2026:76764 | 06.10.2026 |
| Red Hat Enterprise Linux 10 | thunderbird | Fixed | RHSA-2026:80674 | 12.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | thunderbird | Fixed | RHSA-2026:85240 | 19.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | firefox | Fixed | RHSA-2026:92227 | 29.10.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | firefox | Fixed | RHSA-2026:92363 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Sandbox escape due to use-after-free in the DOM: Core & HTML component ...
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
EPSS
6.1 Medium
CVSS3