Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2016374
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-21/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
Affected products
- <149
- <140.9
- <115.34
- <149
- <140.9
Matching in nixpkgs
pkgs.firefoxpwa
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
pkgs.faust2firefox
The faust2firefox script, part of faust functional programming language for realtime audio signal processing
pkgs.firefox_decrypt
Tool to extract passwords from profiles of Mozilla Firefox and derivates
pkgs.pkgsRocm.firefox
Web browser built from Firefox source tree
pkgs.firefox-unwrapped
Web browser built from Firefox source tree
pkgs.firefox-gnome-theme
GNOME theme for Firefox
pkgs.firefox-sync-client
Commandline-utility to list/view/edit/delete entries in a firefox-sync account.
pkgs.pkgsRocm.firefoxpwa
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
pkgs.firefoxpwa-unwrapped
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
pkgs.pkgsRocm.thunderbird
Full-featured e-mail client
pkgs.firefox-esr-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable 140.8.0esr
- nixpkgs-unstable 140.8.0esr
- nixos-unstable-small 140.8.0esr
-
nixos-25.11 140.8.0esr
- nixos-25.11-small 140.8.0esr
- nixpkgs-25.11-darwin 140.8.0esr
pkgs.pkgsRocm.firefox-beta
Web browser built from Firefox Beta Release source tree
pkgs.thunderbird-unwrapped
Full-featured e-mail client
pkgs.firefox-beta-unwrapped
Web browser built from Firefox Beta Release source tree
pkgs.pkgsRocm.firefox-mobile
Web browser built from Firefox source tree
pkgs.firefox-esr-140-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable 140.8.0esr
- nixpkgs-unstable 140.8.0esr
- nixos-unstable-small 140.8.0esr
-
nixos-25.11 140.8.0esr
- nixos-25.11-small 140.8.0esr
- nixpkgs-25.11-darwin 140.8.0esr
pkgs.thunderbird-128-unwrapped
Full-featured e-mail client
pkgs.thunderbird-140-unwrapped
Full-featured e-mail client
-
nixos-unstable 140.7.2esr
- nixpkgs-unstable 140.7.2esr
- nixos-unstable-small 140.7.2esr
-
nixos-25.11 140.7.2esr
- nixos-25.11-small 140.7.2esr
- nixpkgs-25.11-darwin 140.7.2esr
pkgs.thunderbird-esr-unwrapped
Full-featured e-mail client
-
nixos-unstable 140.7.2esr
- nixpkgs-unstable 140.7.2esr
- nixos-unstable-small 140.7.2esr
-
nixos-25.11 140.7.2esr
- nixos-25.11-small 140.7.2esr
- nixpkgs-25.11-darwin 140.7.2esr
pkgs.pkgsRocm.firefox-unwrapped
Web browser built from Firefox source tree
pkgs.pkgsRocm.firefox-devedition
Web browser built from Firefox Developer Edition source tree
pkgs.pkgsRocm.thunderbird-latest
Full-featured e-mail client
pkgs.firefox-devedition-unwrapped
Web browser built from Firefox Developer Edition source tree
pkgs.thunderbird-latest-unwrapped
Full-featured e-mail client
pkgs.pkgsRocm.thunderbird-unwrapped
Full-featured e-mail client
pkgs.pkgsRocm.firefox-beta-unwrapped
Web browser built from Firefox Beta Release source tree
pkgs.thunderbirdPackages.thunderbird
Full-featured e-mail client
pkgs.gnomeExtensions.firefox-profiles
Easily launch Firefox with your favorite profile right from the indicator menu!
pkgs.roundcubePlugins.thunderbird_labels
None
pkgs.thunderbirdPackages.thunderbird-128
Full-featured e-mail client
pkgs.thunderbirdPackages.thunderbird-140
Full-featured e-mail client
-
nixos-unstable 140.7.2esr
- nixpkgs-unstable 140.7.2esr
- nixos-unstable-small 140.7.2esr
-
nixos-25.11 140.7.2esr
- nixos-25.11-small 140.7.2esr
- nixpkgs-25.11-darwin 140.7.2esr
pkgs.thunderbirdPackages.thunderbird-esr
Full-featured e-mail client
-
nixos-unstable 140.7.2esr
- nixpkgs-unstable 140.7.2esr
- nixos-unstable-small 140.7.2esr
-
nixos-25.11 140.7.2esr
- nixos-25.11-small 140.7.2esr
- nixpkgs-25.11-darwin 140.7.2esr
pkgs.pkgsRocm.firefox-devedition-unwrapped
Web browser built from Firefox Developer Edition source tree
pkgs.pkgsRocm.thunderbird-latest-unwrapped
Full-featured e-mail client
pkgs.thunderbirdPackages.thunderbird-latest
Full-featured e-mail client
pkgs.pkgsRocm.thunderbirdPackages.thunderbird
Full-featured e-mail client
pkgs.gnomeExtensions.firefox-pip-always-on-top
Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces
pkgs.gnomeExtensions.pip-alwaysontop-for-firefox
Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.
pkgs.pkgsRocm.thunderbirdPackages.thunderbird-latest
Full-featured e-mail client
pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug
Visual Studio Code extension for debugging web applications and browser extensions in Firefox
Package maintainers
-
@pmahoney Patrick Mahoney <pat@polycrystal.org>
-
@magnetophon Bart Brouns <bart@magnetophon.nl>
-
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
-
@rhendric Ryan Hendrickson
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
-
@lovesegfault Bernardo Meurer <meurerbernardo@gmail.com>
-
@schnusch schnusch
-
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
-
@camillemndn Camille M. <camillemondon@free.fr>
-
@honnip Jung seungwoo <me@honnip.page>
-
@nbp Nicolas B. Pierron <nixos@nbp.name>
-
@vcunat Vladimír Čunát <v@cunat.cz>
-
@felschr Felix Schröter <dev@felschr.com>
-
@nekowinston winston <hey@winston.sh>
-
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>