# Mozilla Patches Dozens of Firefox Flaws

Published: 2026-11-12 · Severity: routine
Canonical: https://vorant.io/reports/77996553-06db-5d79-bda3-4c60ca9a572e/mozilla-patches-dozens-of-firefox-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory covers over 100 Mozilla vulnerabilities fixed in Firefox 160, Firefox ESR 153.7 and Thunderbird 160, some allowing arbitrary code execution.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1505

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published an advisory consolidating five Mozilla security bulletins (MFSA2026-125 through MFSA2026-129) released on 10 November 2026, covering a large number of vulnerabilities across Firefox, Firefox ESR, and Thunderbird. The flaws affect Firefox ESR prior to version 153.7, Firefox prior to version 160, and Thunderbird prior to version 160. Impact ranges from arbitrary code execution and privilege escalation to information disclosure and security policy bypass, with some vulnerability effects left unspecified by the vendor.

No evidence of in-the-wild exploitation is noted in this advisory; it is a routine coordinated disclosure and patch release. Defenders should update affected Mozilla products to the fixed versions (Firefox 160, Firefox ESR 153.7, Thunderbird 160) as soon as possible given the volume and severity range of the fixes, consistent with standard browser-patch hygiene. Given the scale of simultaneous fixes (well over 100 CVEs), organizations with centrally managed Firefox/Thunderbird deployments should prioritize rapid rollout through their patch management pipeline.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109736, CVE-2026-118007, CVE-2026-118019, CVE-2026-118021, CVE-2026-118024, CVE-2026-120572, CVE-2026-124852, CVE-2026-124853, CVE-2026-124854, CVE-2026-124855, CVE-2026-124856, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124862, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124866, CVE-2026-124867, CVE-2026-124868, CVE-2026-124869, CVE-2026-124870, CVE-2026-124871, CVE-2026-124872, CVE-2026-124873, CVE-2026-124874, CVE-2026-124875, CVE-2026-124876, CVE-2026-124877, CVE-2026-124878, CVE-2026-124879, CVE-2026-124880, CVE-2026-126132, CVE-2026-126133, CVE-2026-126134, CVE-2026-126135, CVE-2026-126136

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1505

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/77996553-06db-5d79-bda3-4c60ca9a572e/mozilla-patches-dozens-of-firefox-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup