- update to 153.2.0 ESR (MFSA 2026-80, MFSA 2026-88) - regenerate P11 rust-file-removal: the comm copy of the vendored wast crate changed in 153.2.0, so its one-line .cargo-checksum.json hunk no longer matched (the third_party copy and idna were unaffected) - CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component - CVE-2026-74935: Privilege escalation in the DOM: Networking component - CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component - CVE-2026-74937: Use-after-free in the JavaScript: GC component - CVE-2026-74938: Mitigation bypass in the JavaScript: GC component - CVE-2026-74939: Privilege escalation in the DOM: Navigation component - CVE-2026-74940: Use-after-free in the Graphics: Text component - CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component - CVE-2026-74942: Privilege escalation in the Remote Settings Client component - CVE-2026-74943: Use-after-free in the Graphics: ImageLib component - CVE-2026-74944: Use-after-free in the DOM: Core & HTML component - CVE-2026-74945: Information disclosure in the Graphics: Text component - CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component - CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component - CVE-2026-74948: Information disclosure in the Graphics component - CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component - CVE-2026-74952: Privilege escalation in the Application Update component - CVE-2026-74953: Privilege escalation in the Networking: Cookies component - CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component - CVE-2026-74955: Privilege escalation in the Request Handling component - CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component - CVE-2026-74957: Mitigation bypass in the Safe Browsing component - CVE-2026-74958: Information disclosure in the WebRTC component - CVE-2026-74959: Mitigation bypass in the Storage: Cache API component - CVE-2026-74960: Site isolation issue in the WebExtensions component - CVE-2026-74961: Side-channel in the Web Audio component - CVE-2026-74962: Site isolation issue in the Networking: Cookies component - CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component - CVE-2026-74964: Integer overflow in the Graphics component - CVE-2026-74965: Privilege escalation in the Shell Integration component - CVE-2026-74966: Information disclosure in the Form Autofill component - CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component - CVE-2026-74968: Site isolation issue in the Graphics: WebRender component - CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component - CVE-2026-74970: Site isolation issue in the Graphics component - CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling component - CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component - CVE-2026-74973: Race condition, use-after-free in the Graphics component - CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component - CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component - CVE-2026-74977: Integer overflow in the Graphics component - CVE-2026-74978: Clickjacking issue in the Widget component - CVE-2026-74979: Mitigation bypass in the Add-ons Manager component - CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component - CVE-2026-74982: Denial-of-service in the Widget component - CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component - CVE-2026-74984: Race condition in the JavaScript Engine component - CVE-2026-74985: Privilege escalation in the Enterprise Policies component - CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component - CVE-2026-74987: Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154 - CVE-2026-74988: Internally found bugs fixed in Thunderbird ESR 153.1 and Thunderbird 154 - CVE-2026-74990: Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154 - CVE-2026-75874: Sandbox escape in the Remote Settings Client component