Red Hat Firefox 140.16 Updates RHEL 9 and 10
Tech GuruQuick Answer
Red Hat's Firefox ESR update addresses 28 CVEs on the listed RHEL 9 and 10 streams. Install the branch-specific 140.16.0 RPMs, including firefox-x11 where installed on RHEL 9, then reopen the browser so validation covers the updated process.
Confirm Scope And Apply The Supported Fix
What to do now: Update managed Firefox installations from the entitled RHEL repository and coordinate browser restarts with users. Keep the RHEL 9 and RHEL 10 package release suffixes distinct.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Firefox ESR packages for supported RHEL 9 and RHEL 10 streams |
|---|---|
| Advisory | RHSA-2026:69461 / RHSA-2026:69462 |
| CVEs | CVE-2026-92005, CVE-2026-92006, CVE-2026-92007, CVE-2026-92008, CVE-2026-92009, CVE-2026-92010, CVE-2026-92011, CVE-2026-92012, CVE-2026-92013, CVE-2026-92014, CVE-2026-92015, CVE-2026-92016, CVE-2026-92017, CVE-2026-92018, CVE-2026-92019, CVE-2026-92020, CVE-2026-92021, CVE-2026-92022, CVE-2026-92023, CVE-2026-92024, CVE-2026-92025, CVE-2026-92026, CVE-2026-92027, CVE-2026-92028, CVE-2026-92029, CVE-2026-92030, CVE-2026-92031, CVE-2026-92032 |
| Authoritative release date | RHSA-2026:69461: 2026-09-21T18:15:50+00:00 (CSAF initial release) RHSA-2026:69462: 2026-09-21T20:17:21+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69461: 2026-09-21T18:15:50+00:00 (CSAF revision history) RHSA-2026:69462: 2026-09-21T20:17:21+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | Firefox packages in the RHEL streams covered by RHSA-2026:69461 and :69462 before their respective fixed RPM builds; verify repository and architecture. |
| Fixed version | Firefox 140.16.0-1.el9_8 and 140.16.0-1.el10_2, including the RHEL 9 firefox-x11 package |
| CVSS base score | 6.1 / 7.5 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | The two Red Hat advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The advisories cover memory-safety, browser privilege and sandbox-boundary problems triggered through browser content. Their listed CVSS vectors require user interaction. Red Hat rates the updates Important; the individual CVSS scores span Medium to High and do not establish active exploitation.
What To Validate Now
- Inventory. Locate managed Firefox installations and any installed firefox-x11 packages; record RHEL release, RPM version and responsible desktop owner.
- Establish applicability. Match RHEL 9 to RHSA-2026:69462 and RHEL 10 to :69461; do not use an upstream version number without its RPM release suffix.
- Remediate. Apply Firefox 140.16.0-1.el9_8 and 140.16.0-1.el10_2, including the RHEL 9 firefox-x11 package through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Check the installed Firefox RPMs and reopened browser version. Test required extensions, existing profiles, enterprise sign-in and representative WebGL/browser workloads; record regressions and rollback decisions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
