SUSE-SU-2026:3221-1: critical: Security update for MozillaFirefox

Fri Jul 24 08:32:19 UTC 2026

# Security update for MozillaFirefox

Announcement ID: SUSE-SU-2026:3221-1  
Release Date: 2026-07-23T17:39:41Z  
Rating: critical  
References:

  * bsc#1271649

Cross-References:

  * CVE-2026-15718
  * CVE-2026-15719
  * CVE-2026-16349
  * CVE-2026-16350
  * CVE-2026-16351
  * CVE-2026-16352
  * CVE-2026-16353
  * CVE-2026-16354
  * CVE-2026-16355
  * CVE-2026-16356
  * CVE-2026-16357
  * CVE-2026-16358
  * CVE-2026-16359
  * CVE-2026-16360
  * CVE-2026-16361
  * CVE-2026-16362
  * CVE-2026-16363
  * CVE-2026-16368
  * CVE-2026-16369
  * CVE-2026-16371
  * CVE-2026-16374
  * CVE-2026-16375
  * CVE-2026-16377
  * CVE-2026-16379
  * CVE-2026-16381
  * CVE-2026-16383
  * CVE-2026-16387
  * CVE-2026-16390
  * CVE-2026-16391
  * CVE-2026-16396
  * CVE-2026-16405
  * CVE-2026-16412

CVSS scores:

  * CVE-2026-15718 ( NVD ):  4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
  * CVE-2026-15719 ( NVD ):  5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
  * CVE-2026-16349 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16350 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16351 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16352 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16353 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16354 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16355 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16356 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16357 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16358 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16359 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-16360 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16361 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16362 ( NVD ):  8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-16363 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16368 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16369 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16371 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16374 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16375 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16377 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16379 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16381 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-16383 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16387 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16390 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-16391 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16396 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16405 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16412 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

  * Desktop Applications Module 15-SP7
  * SUSE Linux Enterprise Desktop 15 SP7
  * SUSE Linux Enterprise High Performance Computing 15 SP4
  * SUSE Linux Enterprise High Performance Computing 15 SP5
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
  * SUSE Linux Enterprise Real Time 15 SP7
  * SUSE Linux Enterprise Server 15 SP4
  * SUSE Linux Enterprise Server 15 SP4 LTSS
  * SUSE Linux Enterprise Server 15 SP5
  * SUSE Linux Enterprise Server 15 SP5 LTSS
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server 15 SP6 LTSS
  * SUSE Linux Enterprise Server 15 SP7
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves 32 vulnerabilities can now be installed.

## Description:

This update for MozillaFirefox fixes the following issue:

  * Firefox Extended Support Release 140.13.0 ESR (MFSA 2026-70, bsc#1271649):

  * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component.

  * CVE-2026-15719: Site isolation issue in the DOM: Navigation component.
  * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component.
  * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb
    component.
  * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation
    component.
  * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability
    Access APIs component.
  * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component.
  * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component.
  * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component.
  * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability
    Access APIs component.
  * CVE-2026-16357: Incorrect boundary conditions in the Graphics component.
  * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component.
  * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP
    component.
  * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR
    140.13 and Firefox 153.
  * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox
    ESR 140.13.
  * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component.
  * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component.
  * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly
    component.
  * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component.
  * CVE-2026-16371: Privilege escalation in the DOM: Navigation component.
  * CVE-2026-16374: Information disclosure in the Framework component in
    DevTools.
  * CVE-2026-16375: Site isolation issue in the Networking: HTTP component.
  * CVE-2026-16377: Mitigation bypass in the PDF Viewer component.
  * CVE-2026-16379: Privilege escalation in the DOM: Content Processes
    component.
  * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component.
  * CVE-2026-16383: Mitigation bypass in the DOM: Networking component.
  * CVE-2026-16387: Site isolation issue in the Networking component.
  * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component.
  * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component.
  * CVE-2026-16396: Privilege escalation in WebExtensions.
  * CVE-2026-16405: Information disclosure in the Networking: WebSockets
    component.
  * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox
    153.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-3221=1

  * SUSE Linux Enterprise Server 15 SP6 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3221=1

  * SUSE Linux Enterprise Server 15 SP4 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-3221=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP6  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3221=1

  * SUSE Linux Enterprise Server 15 SP5 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3221=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP4  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-3221=1

  * Desktop Applications Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-3221=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-3221=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3221=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP5  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-3221=1

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-3221=1

## Package List:

  * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * Desktop Applications Module 15-SP7 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
    x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
    x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
    x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
    x86_64)
    * MozillaFirefox-debugsource-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-other-140.13.0-150200.152.248.1
    * MozillaFirefox-debuginfo-140.13.0-150200.152.248.1
    * MozillaFirefox-translations-common-140.13.0-150200.152.248.1
    * MozillaFirefox-140.13.0-150200.152.248.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
    * MozillaFirefox-devel-140.13.0-150200.152.248.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-15718.html
  * https://www.suse.com/security/cve/CVE-2026-15719.html
  * https://www.suse.com/security/cve/CVE-2026-16349.html
  * https://www.suse.com/security/cve/CVE-2026-16350.html
  * https://www.suse.com/security/cve/CVE-2026-16351.html
  * https://www.suse.com/security/cve/CVE-2026-16352.html
  * https://www.suse.com/security/cve/CVE-2026-16353.html
  * https://www.suse.com/security/cve/CVE-2026-16354.html
  * https://www.suse.com/security/cve/CVE-2026-16355.html
  * https://www.suse.com/security/cve/CVE-2026-16356.html
  * https://www.suse.com/security/cve/CVE-2026-16357.html
  * https://www.suse.com/security/cve/CVE-2026-16358.html
  * https://www.suse.com/security/cve/CVE-2026-16359.html
  * https://www.suse.com/security/cve/CVE-2026-16360.html
  * https://www.suse.com/security/cve/CVE-2026-16361.html
  * https://www.suse.com/security/cve/CVE-2026-16362.html
  * https://www.suse.com/security/cve/CVE-2026-16363.html
  * https://www.suse.com/security/cve/CVE-2026-16368.html
  * https://www.suse.com/security/cve/CVE-2026-16369.html
  * https://www.suse.com/security/cve/CVE-2026-16371.html
  * https://www.suse.com/security/cve/CVE-2026-16374.html
  * https://www.suse.com/security/cve/CVE-2026-16375.html
  * https://www.suse.com/security/cve/CVE-2026-16377.html
  * https://www.suse.com/security/cve/CVE-2026-16379.html
  * https://www.suse.com/security/cve/CVE-2026-16381.html
  * https://www.suse.com/security/cve/CVE-2026-16383.html
  * https://www.suse.com/security/cve/CVE-2026-16387.html
  * https://www.suse.com/security/cve/CVE-2026-16390.html
  * https://www.suse.com/security/cve/CVE-2026-16391.html
  * https://www.suse.com/security/cve/CVE-2026-16396.html
  * https://www.suse.com/security/cve/CVE-2026-16405.html
  * https://www.suse.com/security/cve/CVE-2026-16412.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1271649

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260724/8dcd218c/attachment.htm>