Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Clickjacking issue in the Autofill component in Firefox for Android

Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.

Uninitialized memory in the Graphics: WebGPU component

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Sandbox escape in the Graphics: WebGPU component

Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Sandbox escape in the Agent component

Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Information disclosure in the Layout component

Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Mitigation bypass in the SVG component

Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Spoofing issue in the Address Bar component

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Other issue in the Media component in Firefox for Android

Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.

Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Invalid pointer in the Layout: Text and Fonts component

Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

RPC Runtime Elevation of Privilege Vulnerability

Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.

In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Local Information Disclosure via Integer Overflow in smfc Video4Linux Driver

In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory buffers due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

System Component Vulnerability Could Cause Service Unavailability

A vulnerability exists in a system component that may, under certain conditions, disrupt the availability of affected services. Successful exploitation could result in temporary service interruption or loss of functionality.

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.

CVE-2026-126720

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface.