Loading story…
Mozilla released Firefox 147 with fixes for 16 security vulnerabilities, including multiple high-severity sandbox escape issues and memory-safety flaws that could enable arbitrary code execution if exploited. Reported problem areas include the Graphics stack (notably WebGL/Canvas-related code paths), the Messaging System, IPC, and other core browser components; the fixes also apply to Firefox ESR 140.7 and Thunderbird ESR 140.7/147, with vendors urging users to update promptly given ongoing browser-targeted attack activity.
Public reporting highlights that several of the most serious issues involve bypassing Firefox’s isolation model via sandbox escapes in graphics and messaging components, alongside memory corruption bugs (including issues described as likely exploitable with sufficient effort). While no confirmed in-the-wild exploitation was reported in the coverage, the concentration of high-impact graphics-related vulnerabilities underscores continued risk in complex rendering surfaces such as WebGL and Canvas, reinforcing the need for rapid patch deployment across managed endpoints.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
By 2026-01-16, Google had started rolling out Chrome 144.0.7559.59/.60 for desktop, fixing 10 vulnerabilities. The update addressed high-severity issues in the V8 JavaScript engine and Blink rendering engine, and Google awarded $18,500 in bug bounties for six reported flaws.
On 2026-01-13, Mozilla released Firefox 147, Firefox ESR 140.7, and Thunderbird ESR 140.7/147 with fixes for 16 security vulnerabilities. The advisory said seven flaws were rated high severity, including sandbox-escape, graphics, IPC, DOM, networking, and memory-safety issues that could enable arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla released Firefox 146, addressing a series of high-impact security vulnerabilities, including several use-after-free flaws, privilege escalation issues, and a sandbox escape. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation bugs in components such as DOM: Notifications and Netmonitor. Several JIT miscompilation vulnerabilities in the JavaScript Engine were also patched, along with a same-origin policy bypass and spoofing issue in the Downloads Panel. The update also resolves memory safety bugs affecting both Firefox and Thunderbird, some of which could potentially be exploited for remote code execution. Mozilla rates the overall impact of these vulnerabilities as high, urging users to update to Firefox 146 promptly to mitigate risk. The advisories provide CVE identifiers and reference associated bug reports for further technical details.
Jun 29, 2026
Mozilla released Firefox ESR 140.6 to address several high and moderate impact security vulnerabilities, including use-after-free, sandbox escape, privilege escalation, JIT miscompilation, and same-origin policy bypass issues. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation flaws in the DOM: Notifications and Netmonitor components. Several JIT miscompilation bugs in the JavaScript Engine were also patched, which could potentially allow attackers to execute arbitrary code. Additionally, memory safety bugs affecting previous versions of Firefox ESR, Thunderbird, and Firefox were resolved, with some showing evidence of memory corruption that could be exploited. Mozilla recommends updating to Firefox ESR 140.6 to mitigate these risks and ensure systems are protected against these vulnerabilities.
Jun 29, 2026
Google and Mozilla released major browser security updates to address more than 70 vulnerabilities across Chrome and Firefox, many tied to memory-safety weaknesses that could lead to **remote code execution**, **sandbox escape**, or **privilege escalation**. Chrome `149.0.7827.155/.156` fixes 33 flaws, including seven critical issues and 26 high-severity bugs; six of the critical flaws were reported as use-after-free vulnerabilities. Mozilla issued Firefox `152` along with Firefox ESR `115.37` and `140.12`, remediating 40 vulnerabilities affecting areas such as memory corruption, denial of service, spoofing, sensitive information disclosure, and security restriction bypass. Mozilla highlighted **CVE-2026-12304**, a same-origin policy bypass in the Networking: Cookies component with a CVSS score of **9.1**, and **CVE-2026-12289**, a privilege-escalation flaw in Graphics: WebRender rated **8.8**. Firefox’s fixes also covered high-severity bugs involving use-after-free conditions, JIT miscompilation, boundary-condition errors, and sandbox escape. No confirmed in-the-wild exploitation was reported at publication, but organizations were urged to deploy the updates quickly, restart browsers, and enforce enterprise browser-update policies to reduce exposure.
Jul 9, 2026