- CVE-2026-12313: Linux sandbox broker SymlinkPath() accepted paths containing /.. components, allowing a compromised content process to traverse out of allowed directories; reject any path that contains /../, equals .., starts with ../, or ends with /.. (Bug 2040477) - CVE-2026-33636: bundled libpng 1.6.39 NEON palette expansion (arm/palette_neon_intrinsics.c) had an out-of-bounds read/write when row_width was not aligned to chunk size; backport upstream libpng commit aba9f18 that rewrites the loop guard and removes the unsafe post-loop adjustment (compiled but unreachable on x86_64 ESU builds)