Security Vulnerabilities fixed in Firefox ESR 115.38 — Mozilla

BlackTree keeps a versioned source snapshot and links it to relevant CVE reports. The publisher remains authoritative for product applicability, release details and installation guidance.

Read the official article ↗

Publisherwww.mozilla.org

Article IDNo stable ID in source URL

Verified snapshot27 Sept 2026, 02:00 UTC

Linked CVEs13

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

CVE-2026-16361Memory safety bugs fixed in Thunderbird ESR 140.13
CVE-2026-16360Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
CVE-2026-16359Incorrect boundary conditions in the Audio/Video: GMP component
CVE-2026-16358Site isolation issue in the Graphics: WebRender component
CVE-2026-16357Incorrect boundary conditions in the Graphics component
CVE-2026-16356Sandbox escape due to use-after-free in the Disability Access APIs component
CVE-2026-16355JIT miscompilation in the JavaScript Engine: JIT component
CVE-2026-16354Information disclosure in the Graphics: ImageLib component
CVE-2026-16353Invalid pointer in the DOM: Bindings (WebIDL) component
CVE-2026-16352Sandbox escape due to use-after-free in the Disability Access APIs component
CVE-2026-16351Sandbox escape due to use-after-free in the DOM: Navigation component
CVE-2026-16350Incorrect boundary conditions in the Audio/Video: cubeb component
CVE-2026-16349Same-origin policy bypass in the DOM: Navigation component

Source and provenance

Original title: Security Vulnerabilities fixed in Firefox ESR 115.38 — Mozilla. Captured 27 Sept 2026, 02:00 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.

Open the publisher's current version ↗