Loading story…
Mozilla released security advisories addressing vulnerabilities in Firefox and Firefox ESR, prompting the Canadian Centre for Cyber Security to urge organizations and users to apply updates. The affected versions included Firefox releases prior to 149, Firefox ESR releases prior to 115.34, and Firefox ESR releases prior to 140.9, according to the earlier advisory.
A subsequent Mozilla advisory issued additional fixes for the same product lines, affecting Firefox versions prior to 149.0.2, Firefox ESR versions prior to 115.34.1, and Firefox ESR versions prior to 140.9.1. The Canadian Centre for Cyber Security described the notices as vendor patch and mitigation guidance and advised administrators to review Mozilla’s bulletins and deploy the necessary updates across exposed systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Mozilla published additional security advisories on April 7, 2026 for vulnerabilities affecting Firefox versions prior to 149.0.2, Firefox ESR versions prior to 115.34.1, and Firefox ESR versions prior to 140.9.1. The notice described this as a vendor patch and mitigation update rather than active exploitation.
Mozilla published security advisories on March 24, 2026 addressing vulnerabilities affecting Firefox versions prior to 149, Firefox ESR versions prior to 115.34, and Firefox ESR versions prior to 140.9. The Canadian Centre for Cyber Security advised users and administrators to review the advisories and apply the updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla released **critical security updates** for Firefox and Firefox ESR, and the Canadian Centre for Cyber Security urged organizations and users to apply them promptly. The affected versions are **Firefox prior to 153**, **Firefox ESR prior to 140.13**, and **Firefox ESR prior to 115.38**. The advisories were issued as patch guidance rather than a confirmed report of active exploitation, but they address vulnerabilities serious enough to warrant immediate attention. Reporting on the release says Firefox 153 and the updated ESR branches include a broad set of fixes, with one source citing **216 vulnerabilities** resolved. The update also addresses flaws tracked as **`CVE-2026-16411`** and **`CVE-2026-16360`**, alongside multiple memory-safety issues described as potentially exploitable for **arbitrary code execution**. In addition to security remediation, the browser release includes privacy and isolation improvements such as stronger local network access protections and changes to cookie handling behavior.
Jul 21, 2026
Debian issued **DSA-6148-1** to ship a *firefox-esr* security update after Mozilla disclosed numerous vulnerabilities that could enable **arbitrary code execution**, **sandbox escape**, **same-origin policy bypass**, **information disclosure**, and **privilege escalation**. The advisory lists a large set of CVEs (including `CVE-2026-2757` through `CVE-2026-2793`, with gaps) and states fixes are available for Debian *oldstable* (bookworm) in **`firefox-esr` 140.8.0esr-1~deb12u1** (with the notice indicating corresponding updates for *stable* as well). The Canadian Centre for Cyber Security published **AV26-160**, relaying Mozilla’s February 24, 2026 advisories and urging organizations to apply updates for affected Mozilla products, including **Firefox ESR prior to 140.8**, **Firefox ESR prior to 115.33**, and **Firefox prior to 148**. The alert points administrators to Mozilla Foundation Security Advisories **2026-13**, **2026-14**, and **2026-15** as upstream references for the addressed vulnerabilities and remediation guidance.
Jun 29, 2026
Mozilla issued fixes for multiple vulnerabilities affecting **Firefox**, **Firefox ESR**, and **Thunderbird**, prompting publication of dCERT advisories `2026-0976` and `2026-1206`. The advisories indicate that the flaws impact both Mozilla’s mainstream browser releases and its email client, with the later notice expanding coverage to include **Firefox ESR** alongside Firefox and Thunderbird. While the advisories do not provide a public synopsis of the underlying bugs, the coordinated notices show ongoing remediation for several security issues across Mozilla products. Organizations using Firefox, Firefox ESR, or Thunderbird should treat the updates as security-relevant and prioritize deployment through normal patch management processes to reduce exposure to unpatched client-side vulnerabilities.
Jun 29, 2026