First published 21 September 2026 (Pre-Notification)
CVSS:3.1: 10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
Security vulnerabilities have been found in Firefox ESR, a web browser used in IGEL OS. This affects the following product versions:
-
IGEL OS 12
-
IGEL OS 11
Details
Mozilla reports multiple sandbox escapes in Firefox ESR, one in the Remote Settings Client component (CVE-2026-75874), another due to use-after-free in DOM: Navigation (CVE-2026-84119), and one more due to use-after-free in DOM: Security (CVE-2026-84121). Mozilla rates these as high, but CISA-ASP upgrades them to critical. The same applies to a collection of internally found bugs in Firefox ESR (CVE-2026-84143).
Privilege escalation issues affect the DOM: Workers (CVE-2026-16365, high) and Graphics: CanvasWebGL components (CVEs 2026-92006 to 2026-92012, high).
In total, Mozilla reports 40 security issues. The complete list can be found in the References.
Update Instructions
-
OS 12: Upgrade Firefox ESR app to version 140.16 as soon as it is available on the IGEL APP Portal.
-
OS 11: IGEL OS 11 reached End of Maintenance in June 2026. To ensure continued access to security updates and support, we recommend migrating to IGEL OS 12.
References
-
Mozilla Foundation Security Advisory 2026-92: https://www.mozilla.org/en-US/security/advisories/mfsa2026-92/
-
Mozilla Foundation Security Advisory 2026-84: https://www.mozilla.org/en-US/security/advisories/mfsa2026-84/