Mozilla Patches Dozens of Firefox, Thunderbird Flaws
Mozilla fixed multiple vulnerabilities in Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR, some allowing arbitrary code execution; no known exploitation in the wild.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Mozilla has released updates addressing a large batch of vulnerabilities across Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The most severe issues include use-after-free bugs in the DOM, WebRTC, and JavaScript Engine components, along with uninitialized memory issues in Audio/Video and Graphics subsystems, several of which could lead to arbitrary code execution if a user is lured to a malicious page or content (drive-by compromise). Additional lower-severity issues include information disclosure, privilege escalation, spoofing, mitigation bypasses, and denial-of-service conditions spread across NSS libraries, networking, storage, and form autofill components.
CISA/MS-ISAC notes there are currently no reports of in-the-wild exploitation for any of these CVEs. However, given the scope of affected components and the presence of multiple memory-safety and use-after-free bugs, successful exploitation of the most severe flaws could grant an attacker code execution with the privileges of the logged-in user, potentially enabling data theft, account creation, or further compromise depending on user privilege levels.
Organizations should prioritize patching to the fixed versions (Firefox 150, Firefox ESR 140.10/115.35, Thunderbird 150, Thunderbird ESR 140.10) through standard patch management processes. Standard mitigations such as least-privilege enforcement, exploit protection, application allowlisting, and web-content restrictions are recommended to reduce the impact of any future exploitation attempts.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-038
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs