Multiple High-Impact Vulnerabilities Patched in Firefox 146

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Vulnerabilities

13 linked

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Mozilla Product AdvisoriesNews · Dec 9, 2025

Security Vulnerabilities fixed in Firefox 146Open source ↗

Mozilla Product AdvisoriesNews · Jan 1, 1998

Security Vulnerabilities fixed in Firefox 146 - MozillaOpen source ↗

On the same thread

Mozilla released Firefox ESR 140.6 to address several high and moderate impact security vulnerabilities, including use-after-free, sandbox escape, privilege escalation, JIT miscompilation, and same-origin policy bypass issues. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation flaws in the DOM: Notifications and Netmonitor components. Several JIT miscompilation bugs in the JavaScript Engine were also patched, which could potentially allow attackers to execute arbitrary code. Additionally, memory safety bugs affecting previous versions of Firefox ESR, Thunderbird, and Firefox were resolved, with some showing evidence of memory corruption that could be exploited. Mozilla recommends updating to Firefox ESR 140.6 to mitigate these risks and ensure systems are protected against these vulnerabilities.

Dec 9, 2025

Firefox 147 Security Update Fixes Sandbox Escapes and Memory-Safety Bugs

Mozilla released **Firefox 147** with fixes for **16 security vulnerabilities**, including multiple **high-severity sandbox escape** issues and memory-safety flaws that could enable **arbitrary code execution** if exploited. Reported problem areas include the **Graphics** stack (notably WebGL/Canvas-related code paths), the **Messaging System**, IPC, and other core browser components; the fixes also apply to **Firefox ESR 140.7** and **Thunderbird ESR 140.7/147**, with vendors urging users to update promptly given ongoing browser-targeted attack activity. Public reporting highlights that several of the most serious issues involve bypassing Firefox’s isolation model via sandbox escapes in graphics and messaging components, alongside memory corruption bugs (including issues described as likely exploitable with sufficient effort). While no confirmed in-the-wild exploitation was reported in the coverage, the concentration of high-impact graphics-related vulnerabilities underscores continued risk in complex rendering surfaces such as **WebGL** and **Canvas**, reinforcing the need for rapid patch deployment across managed endpoints.

Jan 16, 2026

Mozilla fixes critical flaws in Firefox, ESR, and Thunderbird

Mozilla released security updates for **Firefox 154**, supported **Firefox ESR** branches, and **Thunderbird** to fix a broad set of vulnerabilities affecting desktop and mobile users. Government and vendor advisories said the updates address **3 critical** and **17 high-severity** flaws involving arbitrary code execution, privilege escalation, security restriction bypass, sandbox escape, site isolation failures, use-after-free conditions, and information disclosure. Firefox 154 also introduced product changes including expanded Local Access Network protections for WebSocket connections, while security notices from Canada and Italy urged organizations to review Mozilla bulletins and update affected installations. Tenable and downstream Linux advisories flagged the issue set as **critical** across Windows, macOS, and Slackware packages, with affected versions including Firefox releases prior to 154, multiple ESR builds before their patched versions, and Thunderbird releases prior to **140.14** or **154.0** depending on branch. Nessus coverage tied the fixes to numerous CVEs, including **`CVE-2026-74990`** as a scoring reference in several advisories, and highlighted specific Thunderbird issues such as a Remote Settings Client sandbox escape, a CanvasWebGL site isolation flaw, a DOM: Networking privilege escalation bug, and WebAssembly and garbage-collection use-after-free vulnerabilities. The recommended action across all notices was to upgrade Mozilla products to the latest patched versions immediately.

Aug 25, 2026

Multiple High-Impact Vulnerabilities Patched in Firefox 146

How this story unfolded

Mozilla publishes advisory for vulnerabilities fixed in Firefox 146

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Multiple High-Impact Vulnerabilities Patched in Firefox 146

How this story unfolded

Mozilla publishes advisory for vulnerabilities fixed in Firefox 146

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Multiple High-Impact Vulnerabilities Patched in Firefox 146

How this story unfolded

Mozilla publishes advisory for vulnerabilities fixed in Firefox 146

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

Firefox 147 Security Update Fixes Sandbox Escapes and Memory-Safety Bugs

Mozilla fixes critical flaws in Firefox, ESR, and Thunderbird

Multiple High-Impact Vulnerabilities Patched in Firefox 146

How this story unfolded

Mozilla publishes advisory for vulnerabilities fixed in Firefox 146

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

Firefox 147 Security Update Fixes Sandbox Escapes and Memory-Safety Bugs

Mozilla fixes critical flaws in Firefox, ESR, and Thunderbird