Mozilla Firefox patches critical remote code execution vulnerabilities
Mozilla released patches for 41 vulnerabilities in Firefox, Firefox ESR, and Firefox for iOS, including critical flaws enabling arbitrary code execution and sandbox escapes.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 35 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Mozilla has addressed multiple vulnerabilities across its browser products including Firefox 151, Firefox ESR 140.11 and 115.36, and Firefox for iOS 151.0. The most critical vulnerabilities could allow remote arbitrary code execution through drive-by compromise attacks. High-severity issues include multiple sandbox escape vulnerabilities in Profile Backup, Android versions, and Disability Access APIs components, along with use-after-free conditions in the DOM and memory safety bugs across the JavaScript Engine and Audio/Video subsystems.
The vulnerability set includes numerous same-origin policy bypasses, privilege escalation vectors in DOM, Application Update, and WebRTC components, and information disclosure issues affecting Security, Graphics, and IP Protection modules. Additional flaws involve integer overflows, spoofing attacks against toolbars and form autofill, and mitigation bypasses. The advisory maps these vulnerabilities to MITRE ATT&CK technique T1189 (Drive-by Compromise) under the Initial Access tactic.
No active exploitation has been observed in the wild. Impact depends on user privilege levels, with administrative accounts facing higher risk. Organizations are advised to apply patches immediately after testing and implement defense-in-depth controls including least privilege, exploit protection, URL filtering, application allowlisting, and endpoint detection capabilities.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2026-052
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs