CERT-FR Advisory: Multiple Mozilla Vulnerabilities Patched
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advises patching multiple Firefox and Thunderbird vulnerabilities that could allow arbitrary code execution, data disclosure, or denial of service.
CERT-FR has published an advisory covering multiple vulnerabilities disclosed by Mozilla across Firefox, Firefox ESR, and Thunderbird. The flaws, detailed in Mozilla security bulletins mfsa2026-111 through mfsa2026-115 (dated October 20, 2026), affect Firefox ESR versions prior to 115.43.1 and 153.5.1, Firefox versions prior to 158.0.1, and Thunderbird versions prior to 153.5.1 and 158.0.1. Eight CVEs are referenced in the advisory (CVE-2026-113399, -113400, -113401, -113470, -113866, -113867, -113868, -113869).
According to the advisory, successful exploitation of these vulnerabilities could allow an attacker to achieve arbitrary code execution, compromise data confidentiality, or cause a denial of service; some impacts are not further specified by the vendor. No exploitation in the wild is mentioned in the advisory. Defenders should update affected Firefox and Thunderbird installations to the fixed versions referenced above, consulting Mozilla's official bulletins for per-CVE technical details and patch guidance.
This is a routine vendor patch advisory relayed by CERT-FR; no specific threat actor, campaign, or active exploitation is referenced. Organizations running the affected Mozilla products should prioritize patching per standard vulnerability management processes.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1346
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,853 reports from 140 sources, 513 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs