Mozilla Firefox and Thunderbird multiple vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in Firefox and Thunderbird allow privilege escalation, data theft, and denial of service; update immediately.
CERT-FR has published a security advisory documenting multiple vulnerabilities affecting Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The affected versions include Firefox below 154, Firefox ESR below 115.39, 140.14, and 153.1; Thunderbird below 154, and Thunderbird ESR below 140.14 and 153.1. The vulnerabilities collectively enable privilege escalation, remote denial of service, data confidentiality breaches, and security policy bypasses. Mozilla released seven security bulletins (MFSA2026-74 through MFSA2026-80) on August 18, 2026, addressing these issues across multiple product lines and versions.
Defenders should prioritize patching all affected Firefox and Thunderbird installations to the latest versions. The advisory references 54 individual CVEs but does not provide specific technical details on exploitation vectors or in-the-wild activity. Organizations should consult Mozilla's official security bulletins for detailed patch information and any mitigation guidance for endpoints where immediate updates cannot be deployed. Given the range of impact (privilege escalation, DoS, data theft) and the breadth of affected versions, this warrants high-priority patch management.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1054
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs