Nixpkgs security tracker

Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

References

Affected products

Firefox

=<*
=<140.*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

nixos-unstable -
- nixos-unstable-small 2.85.9
nixos-26.05 -
- nixos-26.05-small 2.85.5

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

nixos-unstable -
- nixos-unstable-small 1.1.3
nixos-26.05 -
- nixos-26.05-small 1.1.3

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.firefox-gnome-theme

GNOME theme for Firefox

nixos-unstable -
- nixos-unstable-small 150
nixos-26.05 -
- nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

nixos-unstable -
- nixos-unstable-small 1.10.0
nixos-26.05 -
- nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

nixos-unstable -
- nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-esr-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr
nixos-26.05 -
- nixos-26.05-small 153.3.0esr

pkgs.pkgsRocm.firefox-beta

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.pkgsRocm.firefox-mobile

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.pkgsRocm.firefox-esr-153

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr

pkgs.firefox-esr-140-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 140.16.0esr
nixos-26.05 -
- nixos-26.05-small 140.16.0esr

pkgs.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr
nixos-26.05 -
- nixos-26.05-small 153.3.0esr

pkgs.pkgsRocm.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.pkgsRocm.firefox-devedition

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0

pkgs.pkgsRocm.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

nixos-unstable -
- nixos-unstable-small 7
nixos-26.05 -
- nixos-26.05-small 7

pkgs.pkgsRocm.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr

pkgs.pkgsRocm.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

nixos-unstable -
- nixos-unstable-small 4
nixos-26.05 -
- nixos-26.05-small 4

pkgs.gnomeExtensions.pip-alwaysontop-for-firefox

Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.

nixos-unstable -
- nixos-unstable-small 1
nixos-26.05 -
- nixos-26.05-small 1

pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug

Visual Studio Code extension for debugging web applications and browser extensions in Firefox

nixos-unstable -
- nixos-unstable-small 2.15.0
nixos-26.05 -
- nixos-26.05-small 2.15.0

Package maintainers

@pmahoney Patrick Mahoney <pat@polycrystal.org>
@magnetophon Bart Brouns <bart@magnetophon.nl>
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
@rhendric Ryan Hendrickson
@philiptaron Philip Taron <philip.taron@gmail.com>
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@nekowinston winston <hey@winston.sh>
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@unode Renato Alves <alves.rjc@gmail.com>
@schnusch schnusch
@camillemndn Camille M. <camillemondon@free.fr>
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
@honnip Jung seungwoo <me@honnip.page>
@felschr Felix Schröter <dev@felschr.com>

Untriaged

Permalink CVE-2026-5674

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 2 months ago Activity log

Created suggestion 2 months ago

Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

References

https://access.redhat.com/security/cve/CVE-2026-5674 x_refsource_REDHATvdb-entry
RHBZ#2455341 issue-trackingx_refsource_REDHAT

Affected products

firefox

libkrun

pipewire

pipewire0.2

Matching in nixpkgs

pkgs.libkrun

Dynamic library providing Virtualization-based process isolation capabilities

nixos-unstable -
- nixos-unstable-small 1.19.0
nixos-26.05 -
- nixos-26.05-small 1.17.4

pkgs.pipewire

Server and user space API to deal with multimedia pipelines

nixos-unstable -
- nixos-unstable-small 1.6.8
nixos-26.05 -
- nixos-26.05-small 1.6.6

pkgs.libkrunfw

Dynamic library bundling the guest payload consumed by libkrun

nixos-unstable -
- nixos-unstable-small 5.5.0
nixos-26.05 -
- nixos-26.05-small 5.3.0

pkgs.libkrun-efi

EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities

nixos-unstable -
- nixos-unstable-small 1.19.4
nixos-26.05 -
- nixos-26.05-small 1.18.0

pkgs.libkrun-sev

Dynamic library providing Virtualization-based process isolation capabilities

nixos-unstable -
- nixos-unstable-small 1.19.0
nixos-26.05 -
- nixos-26.05-small 1.17.4

pkgs.libkrun-tdx

Dynamic library providing Virtualization-based process isolation capabilities

nixos-unstable -
- nixos-unstable-small 1.19.0
nixos-26.05 -
- nixos-26.05-small 1.17.4

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

nixos-unstable -
- nixos-unstable-small 2.85.9
nixos-26.05 -
- nixos-26.05-small 2.85.5

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

nixos-unstable -
- nixos-unstable-small 1.1.3
nixos-26.05 -
- nixos-26.05-small 1.1.3

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.asha-pipewire-sink

Sample ASHA implementation for Linux designed to work with pipewire and bluez

nixos-unstable -
- nixos-unstable-small 0-unstable-2025-05-20
nixos-26.05 -
- nixos-26.05-small 0-unstable-2025-05-20

pkgs.firefox-gnome-theme

GNOME theme for Firefox

nixos-unstable -
- nixos-unstable-small 150
nixos-26.05 -
- nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

nixos-unstable -
- nixos-unstable-small 1.10.0
nixos-26.05 -
- nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

nixos-unstable -
- nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-esr-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr
nixos-26.05 -
- nixos-26.05-small 153.3.0esr

pkgs.gpd-pocket-4-pipewire

Pipewire audio DSP for internal speakers of GPD Pocket 4

nixos-unstable -
- nixos-unstable-small 4-pipewire-0.0.1
nixos-26.05 -
- nixos-26.05-small 4-pipewire-0.0.1

pkgs.kdePackages.kpipewire

Components relating to Flatpak 'pipewire' use in Plasma.

nixos-unstable -
- nixos-unstable-small 6.7.5
nixos-26.05 -
- nixos-26.05-small 6.6.6

pkgs.pkgsRocm.firefox-beta

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.pipewire-control-center

GTK4/libadwaita audio control center for PipeWire

nixos-unstable -
- nixos-unstable-small 0.6.0

pkgs.pkgsRocm.firefox-mobile

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.pkgsRocm.firefox-esr-153

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr

pkgs.firefox-esr-140-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 140.16.0esr
nixos-26.05 -
- nixos-26.05-small 140.16.0esr

pkgs.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr
nixos-26.05 -
- nixos-26.05-small 153.3.0esr

pkgs.pkgsRocm.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.pkgsRocm.firefox-devedition

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0

pkgs.wayland-pipewire-idle-inhibit

Suspends automatic idling of Wayland compositors when media is being played through Pipewire

nixos-unstable -
- nixos-unstable-small 0.7.1
nixos-26.05 -
- nixos-26.05-small 0.7.1

pkgs.pkgsRocm.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

nixos-unstable -
- nixos-unstable-small 7
nixos-26.05 -
- nixos-26.05-small 7

pkgs.gnomeExtensions.pipewire-settings

Top bar menu to set Pipewire's buffer size and samplerate

nixos-unstable -
- nixos-unstable-small 10
nixos-26.05 -
- nixos-26.05-small 9

pkgs.pkgsRocm.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr

pkgs.pkgsRocm.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.gnomeExtensions.pipewire-airplay-toggle

Quick Setting menu toggle to enable/disable the RAOP Discover Module in PipeWire, allowing users to quickly and easily show or hide their AirPlay enabled speakers. This extension now also supports PulseAudio starting from version 8. For full details and dependency information, please review the GitHub repository wiki.

nixos-unstable -
- nixos-unstable-small 12
nixos-26.05 -
- nixos-26.05-small 12

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

nixos-unstable -
- nixos-unstable-small 4
nixos-26.05 -
- nixos-26.05-small 4

pkgs.gnomeExtensions.pip-alwaysontop-for-firefox

Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.

nixos-unstable -
- nixos-unstable-small 1
nixos-26.05 -
- nixos-26.05-small 1

pkgs.obs-studio-plugins.obs-pipewire-audio-capture

Audio device and application capture for OBS Studio using PipeWire

nixos-unstable -
- nixos-unstable-small 1.2.1
nixos-26.05 -
- nixos-26.05-small 1.2.1

pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug

Visual Studio Code extension for debugging web applications and browser extensions in Firefox

nixos-unstable -
- nixos-unstable-small 2.15.0
nixos-26.05 -
- nixos-26.05-small 2.15.0

Package maintainers

@onny Jonas Heinrich <onny@project-insanity.org>
@pmahoney Patrick Mahoney <pat@polycrystal.org>
@magnetophon Bart Brouns <bart@magnetophon.nl>
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
@rhendric Ryan Hendrickson
@philiptaron Philip Taron <philip.taron@gmail.com>
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@nekowinston winston <hey@winston.sh>
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@unode Renato Alves <alves.rjc@gmail.com>
@schnusch schnusch
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
@camillemndn Camille M. <camillemondon@free.fr>
@honnip Jung seungwoo <me@honnip.page>
@MarcelCoding Marcel <me@m4rc3l.de>
@FRidh Frederik Rietdijk <fridh@fridh.nl>
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
@peterhoeg Peter Hoeg <peter@hoeg.com>
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
@NickCao Nick Cao <nickcao@nichi.co>
@K900 Ilya K. <me@0upti.me>
@mjm Matt Moriarity <matt@mattmoriarity.com>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
@bkchr Bastian Köcher <nixos@kchr.de>
@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>
@nrabulinski Nikodem Rabuliński <1337-nix@nrab.lol>
@quinneden Quinn Edenfield <quinn@qeden.dev>
@fxzzi Faaris Ansari <faaris.ansari@proton.me>
@Elinvention Elia Argentieri <elia@elinvention.ovh>
@qweered Aliaksandr Samatyia <grubian2@gmail.com>
@ArisoN-ext ArisoN <arison@duck.com>
@felschr Felix Schröter <dev@felschr.com>
@rafameou Rafael Mazzutti <rafaelmazz22@gmail.com>

Untriaged

Permalink CVE-2026-15718

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 2 months ago Activity log

Created suggestion 2 months ago

Invalid pointer in the JavaScript: WebAssembly component

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.

References

Affected products

Firefox

=<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

nixos-unstable -
- nixos-unstable-small 2.85.9
nixos-26.05 -
- nixos-26.05-small 2.85.5

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

nixos-unstable -
- nixos-unstable-small 1.1.3
nixos-26.05 -
- nixos-26.05-small 1.1.3

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.firefox-gnome-theme

GNOME theme for Firefox

nixos-unstable -
- nixos-unstable-small 150
nixos-26.05 -
- nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

nixos-unstable -
- nixos-unstable-small 1.10.0
nixos-26.05 -
- nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

nixos-unstable -
- nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-esr-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr
nixos-26.05 -
- nixos-26.05-small 153.3.0esr

pkgs.pkgsRocm.firefox-beta

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.pkgsRocm.firefox-mobile

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.pkgsRocm.firefox-esr-153

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr

pkgs.firefox-esr-140-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 140.16.0esr
nixos-26.05 -
- nixos-26.05-small 140.16.0esr

pkgs.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr
nixos-26.05 -
- nixos-26.05-small 153.3.0esr

pkgs.pkgsRocm.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 156.0
nixos-26.05 -
- nixos-26.05-small 156.0

pkgs.pkgsRocm.firefox-devedition

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.19.0

pkgs.pkgsRocm.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

nixos-unstable -
- nixos-unstable-small 7
nixos-26.05 -
- nixos-26.05-small 7

pkgs.pkgsRocm.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.3.0esr

pkgs.pkgsRocm.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 156.0b4
nixos-26.05 -
- nixos-26.05-small 156.0b2

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

nixos-unstable -
- nixos-unstable-small 4
nixos-26.05 -
- nixos-26.05-small 4

pkgs.gnomeExtensions.pip-alwaysontop-for-firefox

Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.

nixos-unstable -
- nixos-unstable-small 1
nixos-26.05 -
- nixos-26.05-small 1

pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug

Visual Studio Code extension for debugging web applications and browser extensions in Firefox

nixos-unstable -
- nixos-unstable-small 2.15.0
nixos-26.05 -
- nixos-26.05-small 2.15.0

Package maintainers

@pmahoney Patrick Mahoney <pat@polycrystal.org>
@magnetophon Bart Brouns <bart@magnetophon.nl>
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
@rhendric Ryan Hendrickson
@philiptaron Philip Taron <philip.taron@gmail.com>
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@nekowinston winston <hey@winston.sh>
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@unode Renato Alves <alves.rjc@gmail.com>
@schnusch schnusch
@camillemndn Camille M. <camillemondon@free.fr>
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
@honnip Jung seungwoo <me@honnip.page>
@felschr Felix Schröter <dev@felschr.com>

Untriaged

Permalink CVE-2026-15719

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 2 months ago Activity log

Created suggestion 2 months ago

Site isolation in the DOM: Navigation component

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.