Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Vulnerabilities

10 linked

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Mozilla Product AdvisoriesNews · Dec 9, 2025

Security Vulnerabilities fixed in Firefox ESR 140.6Open source ↗

Mozilla Product AdvisoriesNews · Dec 9, 2025

Security Vulnerabilities fixed in Firefox ESR 140.6Open source ↗

On the same thread

Mozilla released Firefox 146, addressing a series of high-impact security vulnerabilities, including several use-after-free flaws, privilege escalation issues, and a sandbox escape. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation bugs in components such as DOM: Notifications and Netmonitor. Several JIT miscompilation vulnerabilities in the JavaScript Engine were also patched, along with a same-origin policy bypass and spoofing issue in the Downloads Panel. The update also resolves memory safety bugs affecting both Firefox and Thunderbird, some of which could potentially be exploited for remote code execution. Mozilla rates the overall impact of these vulnerabilities as high, urging users to update to Firefox 146 promptly to mitigate risk. The advisories provide CVE identifiers and reference associated bug reports for further technical details.

Dec 9, 2025

Mozilla Patches Critical Firefox Memory Safety and Security Mitigation Bypass Flaws

Mozilla released Firefox 153, Firefox ESR 140.13, and Firefox ESR 115.38 to address multiple security vulnerabilities, according to an EG-FinCIRT advisory published July 22. The advisory highlights **CVE-2026-16361**, a memory safety vulnerability rated CVSS 9.8 that could enable remote code execution, and **CVE-2026-16394**, a DOM security mitigation bypass rated CVSS 9.1. The advisory describes both highlighted flaws as remotely exploitable with low attack complexity, no privileges, and no user interaction. Organizations should prioritize testing and deploying the applicable Firefox and ESR updates across managed endpoints; EG-FinCIRT recommends installation as soon as testing is complete.

Jul 22, 2026

Critical Vulnerabilities in Mozilla Firefox and Firefox ESR Allowing Arbitrary Code Execution

Multiple critical vulnerabilities were identified in Mozilla Firefox and Firefox ESR, with the most severe enabling arbitrary code execution. Affected versions include Firefox prior to 146, Firefox ESR prior to 115.31, and Firefox ESR prior to 140.6. The vulnerabilities include use-after-free in WebRTC (`CVE-2025-14321`), sandbox escape in Graphics (`CVE-2025-14322`), privilege escalation in the DOM (`CVE-2025-14323`), JIT miscompilation in the JavaScript Engine (`CVE-2025-14324`, `CVE-2025-14325`), and multiple memory safety bugs. Exploitation could allow attackers to install programs, modify or delete data, or create new accounts with full user rights, depending on the privileges of the compromised user. There are currently no reports of these vulnerabilities being exploited in the wild. Security advisories from both the Canadian Centre for Cyber Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC) urge users and administrators to apply the latest updates immediately to mitigate risk. The advisories highlight the importance of prompt patching, especially for large organizations and government entities, as the risk is assessed as high for these sectors. The updates address all known vulnerabilities, and users with fewer system privileges are less impacted than those with administrative rights.

Jan 1, 2026

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

How this story unfolded

Mozilla releases Firefox ESR 140.6 security fixes

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

How this story unfolded

Mozilla releases Firefox ESR 140.6 security fixes

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

How this story unfolded

Mozilla releases Firefox ESR 140.6 security fixes

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple High-Impact Vulnerabilities Patched in Firefox 146

Mozilla Patches Critical Firefox Memory Safety and Security Mitigation Bypass Flaws

Critical Vulnerabilities in Mozilla Firefox and Firefox ESR Allowing Arbitrary Code Execution

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

How this story unfolded

Mozilla releases Firefox ESR 140.6 security fixes

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple High-Impact Vulnerabilities Patched in Firefox 146

Mozilla Patches Critical Firefox Memory Safety and Security Mitigation Bypass Flaws

Critical Vulnerabilities in Mozilla Firefox and Firefox ESR Allowing Arbitrary Code Execution