Loading story…
Mozilla released an out-of-band update to Firefox 147.0.4 to fix CVE-2026-2447, a high-impact heap buffer overflow in the libvpx video codec library used to decode VP8/VP9 content. The flaw could be triggered via specially crafted video/media streams delivered through web pages, potentially leading to arbitrary code execution, browser crashes, or broader system compromise; the issue was reported by researcher jayjayjazz. Mozilla also shipped corresponding fixes to supported ESR lines (Firefox ESR 140.7.1 and Firefox ESR 115.32.1), reflecting the breadth of exposure across supported platforms.
Canada’s Canadian Centre for Cyber Security echoed Mozilla’s guidance, urging organizations to apply the updates across Firefox, Firefox ESR, and Thunderbird (per Mozilla’s advisories) to remediate the affected versions. Separate reporting described a different Firefox RCE condition tied to a SpiderMonkey WebAssembly GC logic error (a & vs | typo) and separate Microsoft Edge items (including an advisory noting an exploitable CVE-2026-2441 and an article focused on Edge 145 enterprise security features); those are not part of the libvpx CVE-2026-2447 disclosure and should be tracked independently.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-17, the Canadian Centre for Cyber Security published advisory AV26-136 highlighting Mozilla's security fixes and urging users and administrators to review the advisories and apply the necessary updates. The notice referenced affected Firefox, Firefox ESR, and Thunderbird versions.
Mozilla issued an out-of-band update to address CVE-2026-2447, a high-severity heap buffer overflow in the libvpx video codec library used for VP8/VP9 decoding in Firefox. The flaw, reported by researcher jayjayjazz, could be triggered by crafted video content and may allow crashes, arbitrary code execution, or system compromise.
On 2026-02-16, Mozilla published security advisories covering vulnerabilities in multiple products, including Firefox, Firefox ESR, and Thunderbird. The advisories included fixes in Firefox 147.0.4, Firefox ESR 140.7.1 and 115.32.1, and Thunderbird 147.0.2 and 140.7.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla released security updates for **Firefox 154**, supported **Firefox ESR** branches, and **Thunderbird** to fix a broad set of vulnerabilities affecting desktop and mobile users. Government and vendor advisories said the updates address **3 critical** and **17 high-severity** flaws involving arbitrary code execution, privilege escalation, security restriction bypass, sandbox escape, site isolation failures, use-after-free conditions, and information disclosure. Firefox 154 also introduced product changes including expanded Local Access Network protections for WebSocket connections, while security notices from Canada and Italy urged organizations to review Mozilla bulletins and update affected installations. Tenable and downstream Linux advisories flagged the issue set as **critical** across Windows, macOS, and Slackware packages, with affected versions including Firefox releases prior to 154, multiple ESR builds before their patched versions, and Thunderbird releases prior to **140.14** or **154.0** depending on branch. Nessus coverage tied the fixes to numerous CVEs, including **`CVE-2026-74990`** as a scoring reference in several advisories, and highlighted specific Thunderbird issues such as a Remote Settings Client sandbox escape, a CanvasWebGL site isolation flaw, a DOM: Networking privilege escalation bug, and WebAssembly and garbage-collection use-after-free vulnerabilities. The recommended action across all notices was to upgrade Mozilla products to the latest patched versions immediately.
Aug 26, 2026
Multiple critical vulnerabilities were identified in Mozilla Firefox and Firefox ESR, with the most severe enabling arbitrary code execution. Affected versions include Firefox prior to 146, Firefox ESR prior to 115.31, and Firefox ESR prior to 140.6. The vulnerabilities include use-after-free in WebRTC (`CVE-2025-14321`), sandbox escape in Graphics (`CVE-2025-14322`), privilege escalation in the DOM (`CVE-2025-14323`), JIT miscompilation in the JavaScript Engine (`CVE-2025-14324`, `CVE-2025-14325`), and multiple memory safety bugs. Exploitation could allow attackers to install programs, modify or delete data, or create new accounts with full user rights, depending on the privileges of the compromised user. There are currently no reports of these vulnerabilities being exploited in the wild. Security advisories from both the Canadian Centre for Cyber Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC) urge users and administrators to apply the latest updates immediately to mitigate risk. The advisories highlight the importance of prompt patching, especially for large organizations and government entities, as the risk is assessed as high for these sectors. The updates address all known vulnerabilities, and users with fewer system privileges are less impacted than those with administrative rights.
Jun 29, 2026
Mozilla released Firefox ESR 140.6 to address several high and moderate impact security vulnerabilities, including use-after-free, sandbox escape, privilege escalation, JIT miscompilation, and same-origin policy bypass issues. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation flaws in the DOM: Notifications and Netmonitor components. Several JIT miscompilation bugs in the JavaScript Engine were also patched, which could potentially allow attackers to execute arbitrary code. Additionally, memory safety bugs affecting previous versions of Firefox ESR, Thunderbird, and Firefox were resolved, with some showing evidence of memory corruption that could be exploited. Mozilla recommends updating to Firefox ESR 140.6 to mitigate these risks and ensure systems are protected against these vulnerabilities.
Jun 29, 2026