# Multiple vulnerabilities in Mozilla Firefox and Thunderbird

Published: 2026-06-17 · Severity: routine
Canonical: https://vorant.io/reports/610239fc-3467-50e4-bcfb-839c9f568473/multiple-vulnerabilities-in-mozilla-firefox-and-thunderbird
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Multiple flaws in Firefox, Thunderbird, and iOS versions enable remote code execution, privilege escalation, and denial of service.

Source: cert.ssi.gouv.fr — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0764

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published a security advisory documenting multiple vulnerabilities affecting Mozilla products released on 16 June 2026. Affected versions include Firefox versions prior to 152, Firefox ESR versions prior to 115.37 and 140.12, Firefox for iOS prior to 152.0, Thunderbird versions prior to 152, and Thunderbird ESR versions prior to 140.12. The vulnerabilities enable attackers to achieve remote code execution, privilege escalation, denial of service, circumvent security policy, and compromise data confidentiality. The advisory references six Mozilla security bulletins (mfsa2026-56 through mfsa2026-61) and 43 CVE identifiers covering the full scope of issues. Organizations should apply patches immediately as these flaws affect widely-deployed browser and email client software used across enterprise and consumer environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-12289, CVE-2026-12290, CVE-2026-12291, CVE-2026-12292, CVE-2026-12293, CVE-2026-12294, CVE-2026-12295, CVE-2026-12296, CVE-2026-12297, CVE-2026-12298, CVE-2026-12299, CVE-2026-12300, CVE-2026-12301, CVE-2026-12302, CVE-2026-12303, CVE-2026-12304, CVE-2026-12305, CVE-2026-12306, CVE-2026-12307, CVE-2026-12308, CVE-2026-12309, CVE-2026-12310, CVE-2026-12311, CVE-2026-12312, CVE-2026-12313, CVE-2026-12314, CVE-2026-12315, CVE-2026-12316, CVE-2026-12317, CVE-2026-12318, CVE-2026-12319, CVE-2026-12320, CVE-2026-12321, CVE-2026-12322, CVE-2026-12323, CVE-2026-12324, CVE-2026-12325, CVE-2026-12326, CVE-2026-12327, CVE-2026-12328

## Detection guidance (public sample)

### Firefox or Thunderbird Spawning Script Interpreter or LOLBin

ATT&CK: T1203

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects Firefox or Thunderbird launching a shell, script host or download LOLBin, a common sign of successful browser or mail client exploitation leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firefox or Thunderbird Spawning Script Interpreter or LOLBin
description: Detects Mozilla Firefox or Thunderbird directly spawning a command shell,
  PowerShell, script host or download/execution LOLBin. Browsers and mail clients
  rarely start these, so a hit may indicate client-side exploitation (remote code
  execution) or a sandbox escape. The advisory gives no exploit specifics, so this
  is generic post-exploitation behaviour.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \firefox.exe
    - \thunderbird.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Browser extensions or native messaging hosts that deliberately launch a script interpreter
- Developers using custom protocol handlers or external-application launchers configured
  in Firefox
level: medium
id: 3a6f5c66-ea4f-5823-8c6d-1d7d8198b255
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0764
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0764

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/610239fc-3467-50e4-bcfb-839c9f568473/multiple-vulnerabilities-in-mozilla-firefox-and-thunderbird.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup