Mozilla's advisory MFSA 2026-90 (announced 15 September 2026) lists 73 vulnerabilities fixed in Firefox 156, with an overall impact of high; Mozilla rates 27 of them high, 26 moderate and 20 low. Mozilla notes that it no longer rolls all internally identified memory-safety vulnerabilities into a single CVE and now issues an advisory entry for every individual bug. Entries include a use-after-free in Audio/Video: Web Codecs (CVE-2026-92005), privilege escalations due to incorrect boundary conditions in Graphics: CanvasWebGL (CVE-2026-92006 to CVE-2026-92013), a sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) and a sandbox escape in DOM: Core & HTML (CVE-2026-92018).

Mozilla does not say any of them is being exploited in the wild. (source: Mozilla MFSA 2026-90)