# Mozilla Firefox and Thunderbird multiple vulnerabilities

Published: 2026-08-19 · Severity: routine
Canonical: https://vorant.io/reports/930dffec-0d85-5a3c-b16f-93b0570f2749/mozilla-firefox-and-thunderbird-multiple-vulnerabilities

> Multiple vulnerabilities in Firefox and Thunderbird allow privilege escalation, data theft, and denial of service; update immediately.

CERT-FR has published a security advisory documenting multiple vulnerabilities affecting Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The affected versions include Firefox below 154, Firefox ESR below 115.39, 140.14, and 153.1; Thunderbird below 154, and Thunderbird ESR below 140.14 and 153.1. The vulnerabilities collectively enable privilege escalation, remote denial of service, data confidentiality breaches, and security policy bypasses. Mozilla released seven security bulletins (MFSA2026-74 through MFSA2026-80) on August 18, 2026, addressing these issues across multiple product lines and versions.

Defenders should prioritize patching all affected Firefox and Thunderbird installations to the latest versions. The advisory references 54 individual CVEs but does not provide specific technical details on exploitation vectors or in-the-wild activity. Organizations should consult Mozilla's official security bulletins for detailed patch information and any mitigation guidance for endpoints where immediate updates cannot be deployed. Given the range of impact (privilege escalation, DoS, data theft) and the breadth of affected versions, this warrants high-priority patch management.

## Mentioned in this report

- Vulnerabilities: CVE-2026-74934, CVE-2026-74935, CVE-2026-74936, CVE-2026-74937, CVE-2026-74938, CVE-2026-74939, CVE-2026-74940, CVE-2026-74941, CVE-2026-74942, CVE-2026-74943, CVE-2026-74944, CVE-2026-74945, CVE-2026-74946, CVE-2026-74947, CVE-2026-74948, CVE-2026-74949, CVE-2026-74950, CVE-2026-74951, CVE-2026-74952, CVE-2026-74953, CVE-2026-74954, CVE-2026-74955, CVE-2026-74956, CVE-2026-74957, CVE-2026-74958, CVE-2026-74959, CVE-2026-74960, CVE-2026-74961, CVE-2026-74962, CVE-2026-74963, CVE-2026-74964, CVE-2026-74965, CVE-2026-74966, CVE-2026-74967, CVE-2026-74968, CVE-2026-74969, CVE-2026-74970, CVE-2026-74971, CVE-2026-74972, CVE-2026-74973

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1054

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/930dffec-0d85-5a3c-b16f-93b0570f2749/mozilla-firefox-and-thunderbird-multiple-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup