This security update addresses three vulnerabilities in Mozilla Firefox, including a critical (CVSS 9.8) unspecified issue in the WebRTC component (CVE-2026-8094), a high-severity use-after-free in the DOM: Networking component (CVE-2026-8090, CVSS 7.3), and memory safety bugs (CVE-2026-8092, CVSS 8.1). Affected versions vary per CVE, with Firefox versions prior to 115.35.2, between 128.0 and 140.10.2, and between 150.0 and 150.0.2 being impacted. The fixed versions are Firefox ESR 115.35.2, Firefox ESR 140.10.2, and Firefox 150.0.2, as detailed in the NVD data.
Red Hat Product Errata RHSA-2026:24510 - Security Advisory Issued: 2026-06-08 Updated: 2026-06-08 RHSA-2026:24510 - Security Advisory Overview Updated Packages Synopsis Important: firefox security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for firefox is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): firefox: Other issue in the WebRTC component (CVE-2026-8094) firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092) firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2467706 - CVE-2026-8094 firefox: thunderbird: Other issue in the WebRTC component BZ - 2467708 - CVE-2026-8092 firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 BZ - 2467709 - CVE-2026-8090 firefox: thunderbird: Use-after-free in the DOM: Networking component CVEs CVE-2026-8090 CVE-2026-8092 CVE-2026-8094 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 x86_64 firefox-140.10.2-1.el9_4.x86_64.rpm SHA-256: 6ca4675cf3e444a3a499488a6498c05065a9a693febd581c626ebe063dc54dc3 firefox-debuginfo-140.10.2-1.el9_4.x86_64.rpm SHA-256: aaef2ba10ed99c5f0f137acf608487dca37326e8d0126066b13cb4857fbe6d87 firefox-debugsource-140.10.2-1.el9_4.x86_64.rpm SHA-256: af598dc555772e8d50a08f2763665e5a2c9e90c01292c6e5bf3f2164279887ce firefox-x11-140.10.2-1.el9_4.x86_64.rpm SHA-256: e2c87c6e6d3704bdd9add2d96e06c292a8a690c7fffce0e70272f94b07dbbcef Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 ppc64le firefox-140.10.2-1.el9_4.ppc64le.rpm SHA-256: 029b2227b980dcba8f386e59194e04495a33c9bc2841a60ecb8f47da1d77ef2b firefox-debuginfo-140.10.2-1.el9_4.ppc64le.rpm SHA-256: d6dfcac464355a36966f09d2325085935a7dd5b3e1342755a76326d6bbee1d21 firefox-debugsource-140.10.2-1.el9_4.ppc64le.rpm SHA-256: 96a52c708a3a8d6009f3ce5e923d8d01cdba4d560067017e1d3cc504be39ed22 firefox-x11-140.10.2-1.el9_4.ppc64le.rpm SHA-256: 9fb3145dda60130b6fe14f88fe85fa24502a5a9647bfdb2e99ff10a49630194d Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 x86_64 firefox-140.10.2-1.el9_4.x86_64.rpm SHA-256: 6ca4675cf3e444a3a499488a6498c05065a9a693febd581c626ebe063dc54dc3 firefox-debuginfo-140.10.2-1.el9_4.x86_64.rpm SHA-256: aaef2ba10ed99c5f0f137acf608487dca37326e8d0126066b13cb4857fbe6d87 firefox-debugsource-140.10.2-1.el9_4.x86_64.rpm SHA-256: af598dc555772e8d50a08f2763665e5a2c9e90c01292c6e5bf3f2164279887ce firefox-x11-140.10.2-1.el9_4.x86_64.rpm SHA-256: e2c87c6e6d3704bdd9add2d96e06c292a8a690c7fffce0e70272f94b07dbbcef Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 aarch64 firefox-140.10.2-1.el9_4.aarch64.rpm SHA-256: f88c2d22603d791a27bf2ab516e5df7d9e1d9304eff303b36e015da81b4dbb51 firefox-debuginfo-140.10.2-1.el9_4.aarch64.rpm SHA-256: 485964b01738519d173c45dfb92d0b39d62b9486001a36561de1b022469282f1 firefox-debugsource-140.10.2-1.el9_4.aarch64.rpm SHA-256: f3704148ee7e65838c209be86077891d301e6792ec7d6b33fc16713317539211 firefox-x11-140.10.2-1.el9_4.aarch64.rpm SHA-256: 32a698dfe109ad85c1868836355bb45a73fdedd9d981ee44a71809a547e19687 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 s390x firefox-140.10.2-1.el9_4.s390x.rpm SHA-256: 2cc53a58697e173e51512001551d2301f6ef7835942123958ca02755e9081510 firefox-debuginfo-140.10.2-1.el9_4.s390x.rpm SHA-256: d684b7e56c60473251de5c3d94dfa38daa0fee90a78e26229b0ae2220cd441c4 firefox-debugsource-140.10.2-1.el9_4.s390x.rpm SHA-256: e5215dc09af8397d62ef51133cf4fe3da1f976bf5599ef311bb85356156125e4 firefox-x11-140.10.2-1.el9_4.s390x.rpm SHA-256: fb1dcfc99db902f2c7e1b1c8b6326c096ff866055585a7e9fbde86a9e6c8ed54 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 x86_64 firefox-140.10.2-1.el9_4.x86_64.rpm SHA-256: 6ca4675cf3e444a3a499488a6498c05065a9a693febd581c626ebe063dc54dc3 firefox-debuginfo-140.10.2-1.el9_4.x86_64.rpm SHA-256: aaef2ba10ed99c5f0f137acf608487dca37326e8d0126066b13cb4857fbe6d87 firefox-debugsource-140.10.2-1.el9_4.x86_64.rpm SHA-256: af598dc555772e8d50a08f2763665e5a2c9e90c01292c6e5bf3f2164279887ce firefox-x11-140.10.2-1.el9_4.x86_64.rpm SHA-256: e2c87c6e6d3704bdd9add2d96e06c292a8a690c7fffce0e70272f94b07dbbcef Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 aarch64 firefox-140.10.2-1.el9_4.aarch64.rpm SHA-256: f88c2d22603d791a27bf2ab516e5df7d9e1d9304eff303b36e015da81b4dbb51 firefox-debuginfo-140.10.2-1.el9_4.aarch64.rpm SHA-256: 485964b01738519d173c45dfb92d0b39d62b9486001a36561de1b022469282f1 firefox-debugsource-140.10.2-1.el9_4.aarch64.rpm SHA-256: f3704148ee7e65838c209be86077891d301e6792ec7d6b33fc16713317539211 firefox-x11-140.10.2-1.el9_4.aarch64.rpm SHA-256: 32a698dfe109ad85c1868836355bb45a73fdedd9d981ee44a71809a547e19687 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 ppc64le firefox-140.10.2-1.el9_4.ppc64le.rpm SHA-256: 029b2227b980dcba8f386e59194e04495a33c9bc2841a60ecb8f47da1d77ef2b firefox-debuginfo-140.10.2-1.el9_4.ppc64le.rpm SHA-256: d6dfcac464355a36966f09d2325085935a7dd5b3e1342755a76326d6bbee1d21 firefox-debugsource-140.10.2-1.el9_4.ppc64le.rpm SHA-256: 96a52c708a3a8d6009f3ce5e923d8d01cdba4d560067017e1d3cc504be39ed22 firefox-x11-140.10.2-1.el9_4.ppc64le.rpm SHA-256: 9fb3145dda60130b6fe14f88fe85fa24502a5a9647bfdb2e99ff10a49630194d Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 SRPM firefox-140.10.2-1.el9_4.src.rpm SHA-256: c0dad751f88043d1f88dc148e804d91d3aa549a59cd3005845ded226dc928599 s390x firefox-140.10.2-1.el9_4.s390x.rpm SHA-256: 2cc53a58697e173e51512001551d2301f6ef7835942123958ca02755e9081510 firefox-debuginfo-140.10.2-1.el9_4.s390x.rpm SHA-256: d684b7e56c60473251de5c3d94dfa38daa0fee90a78e26229b0ae2220cd441c4 firefox-debugsource-140.10.2-1.el9_4.s390x.rpm SHA-256: e5215dc09af8397d62ef51133cf4fe3da1f976bf5599ef311bb85356156125e4 firefox-x11-140.10.2-1.el9_4.s390x.rpm SHA-256: fb1dcfc99db902f2c7e1b1c8b6326c096ff866055585a7e9fbde86a9e6c8ed54 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .