Mozilla Patches Dozens of Firefox Flaws
CERT-FR advisory covers over 100 Mozilla vulnerabilities fixed in Firefox 160, Firefox ESR 153.7 and Thunderbird 160, some allowing arbitrary code execution.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published an advisory consolidating five Mozilla security bulletins (MFSA2026-125 through MFSA2026-129) released on 10 November 2026, covering a large number of vulnerabilities across Firefox, Firefox ESR, and Thunderbird. The flaws affect Firefox ESR prior to version 153.7, Firefox prior to version 160, and Thunderbird prior to version 160. Impact ranges from arbitrary code execution and privilege escalation to information disclosure and security policy bypass, with some vulnerability effects left unspecified by the vendor.
No evidence of in-the-wild exploitation is noted in this advisory; it is a routine coordinated disclosure and patch release. Defenders should update affected Mozilla products to the fixed versions (Firefox 160, Firefox ESR 153.7, Thunderbird 160) as soon as possible given the volume and severity range of the fixes, consistent with standard browser-patch hygiene. Given the scale of simultaneous fixes (well over 100 CVEs), organizations with centrally managed Firefox/Thunderbird deployments should prioritize rapid rollout through their patch management pipeline.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1505
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs