Mozilla Patches Dozens of Firefox Flaws
CERT-FR warns of multiple vulnerabilities in Firefox, Firefox ESR, and Thunderbird enabling remote code execution, privilege escalation, and denial of service.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR issued an advisory covering multiple vulnerabilities disclosed in Mozilla's Firefox, Firefox ESR, and Thunderbird products, detailed across five Mozilla Security Advisory bulletins (mfsa2026-118 through mfsa2026-122) published on 27 October 2026. The flaws affect Firefox versions prior to 159, Firefox ESR prior to 115.44 and 153.6, and Thunderbird versions prior to 153.6 and 159. Mozilla assigned a very large number of CVE identifiers to this batch, with impacts including remote code execution, privilege escalation, remote denial of service, security policy bypass, and confidentiality breaches; some issues carry unspecified impact per the vendor.
No evidence of active exploitation is mentioned in the advisory. CERT-FR's guidance is standard: apply the vendor-supplied patches referenced in the Mozilla security bulletins without delay. Given the scale and breadth of affected components across both the browser and mail client, organizations should prioritize updating to the fixed versions (Firefox 159+, Firefox ESR 115.44+/153.6+, Thunderbird 153.6+/159+) as part of routine patch management.
Defenders should treat this as a standard high-volume Mozilla patch cycle: verify deployed Firefox/Thunderbird/ESR versions across the environment, prioritize systems exposed to untrusted web content or email, and apply updates via standard software management channels. No specific indicators of compromise or in-the-wild exploitation were reported in this bulletin.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1406
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs