Описание
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
A flaw was found in Firefox. Incorrect boundary condition handling in the Win32 widget component allows an attacker to escape the browser's restricted sandbox environment. An attacker who has compromised a sandboxed content process could exploit this vulnerability to achieve privilege escalation and execute arbitrary code on the underlying operating system.
Отчет
This vulnerability is rated as Important severity because escaping the client sandbox allows an attacker who has compromised a content process to execute arbitrary code with the privileges of the host process. However, the vulnerable boundary condition resides exclusively within the Win32 widget subsystem developed for Microsoft Windows. Red Hat Enterprise Linux builds of Firefox and Thunderbird utilize the GTK windowing implementation and do not include the Windows-specific code, preventing exposure in Red Hat environments.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rhel10/firefox-flatpak | Affected | ||
| Red Hat Enterprise Linux 10 | rhel10/thunderbird-flatpak | Affected | ||
| Red Hat Enterprise Linux 10 | thunderbird | Affected | ||
| Red Hat Enterprise Linux 6 | firefox | Out of support scope | ||
| Red Hat Enterprise Linux 6 | thunderbird | Out of support scope | ||
| Red Hat Enterprise Linux 7 | firefox | Affected | ||
| Red Hat Enterprise Linux 7 | thunderbird | Out of support scope | ||
| Red Hat Enterprise Linux 8 | thunderbird | Affected | ||
| Red Hat Enterprise Linux 10 | firefox | Fixed | RHSA-2026:89758 | 26.10.2026 |
| Red Hat Enterprise Linux 8 | firefox | Fixed | RHSA-2026:89756 | 26.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sandbox escape due to incorrect boundary conditions in the Widget: Win ...
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
EPSS
6.1 Medium
CVSS3