# Mozilla Patches Dozens of Firefox Flaws

Published: 2026-10-28 · Severity: routine
Canonical: https://vorant.io/reports/e908c02b-6dd9-5f88-af97-39c20ab24dd1/mozilla-patches-dozens-of-firefox-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns of multiple vulnerabilities in Firefox, Firefox ESR, and Thunderbird enabling remote code execution, privilege escalation, and denial of service.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1406

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR issued an advisory covering multiple vulnerabilities disclosed in Mozilla's Firefox, Firefox ESR, and Thunderbird products, detailed across five Mozilla Security Advisory bulletins (mfsa2026-118 through mfsa2026-122) published on 27 October 2026. The flaws affect Firefox versions prior to 159, Firefox ESR prior to 115.44 and 153.6, and Thunderbird versions prior to 153.6 and 159. Mozilla assigned a very large number of CVE identifiers to this batch, with impacts including remote code execution, privilege escalation, remote denial of service, security policy bypass, and confidentiality breaches; some issues carry unspecified impact per the vendor.

No evidence of active exploitation is mentioned in the advisory. CERT-FR's guidance is standard: apply the vendor-supplied patches referenced in the Mozilla security bulletins without delay. Given the scale and breadth of affected components across both the browser and mail client, organizations should prioritize updating to the fixed versions (Firefox 159+, Firefox ESR 115.44+/153.6+, Thunderbird 153.6+/159+) as part of routine patch management.

Defenders should treat this as a standard high-volume Mozilla patch cycle: verify deployed Firefox/Thunderbird/ESR versions across the environment, prioritize systems exposed to untrusted web content or email, and apply updates via standard software management channels. No specific indicators of compromise or in-the-wild exploitation were reported in this bulletin.

## Mentioned in this report

- Vulnerabilities: CVE-2026-100801, CVE-2026-109705, CVE-2026-109707, CVE-2026-109708, CVE-2026-110247, CVE-2026-113869, CVE-2026-117860, CVE-2026-117861, CVE-2026-117862, CVE-2026-117863, CVE-2026-117864, CVE-2026-117865, CVE-2026-117866, CVE-2026-117867, CVE-2026-117868, CVE-2026-117869, CVE-2026-117870, CVE-2026-117871, CVE-2026-117872, CVE-2026-117873, CVE-2026-117874, CVE-2026-117875, CVE-2026-117876, CVE-2026-117877, CVE-2026-117878, CVE-2026-117879, CVE-2026-117880, CVE-2026-117881, CVE-2026-117882, CVE-2026-117883, CVE-2026-117884, CVE-2026-117885, CVE-2026-117886, CVE-2026-117887, CVE-2026-117888, CVE-2026-117889, CVE-2026-117890, CVE-2026-117891, CVE-2026-117892, CVE-2026-117893

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1406

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e908c02b-6dd9-5f88-af97-39c20ab24dd1/mozilla-patches-dozens-of-firefox-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup