Loading story…
Mozilla published security advisories for Firefox 149 and Firefox 149.0.2, disclosing that both releases contain fixes for security vulnerabilities in the browser. The advisories, tracked as MFSA-2026-20 and MFSA-2026-25, indicate that Mozilla issued follow-up updates to address flaws affecting Firefox users.
While the advisories provided here do not include vulnerability synopses, the paired releases show Mozilla delivering both a major browser update and a subsequent point release with additional security fixes. Organizations using Firefox should review the affected versions and prioritize upgrading to the latest available release to reduce exposure to browser-based attacks.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Mozilla published advisory MFSA 2026-20 covering security vulnerabilities fixed in Firefox 149. The advisory was released on 2026-03-24.
Mozilla published advisory MFSA 2026-25 for security vulnerabilities fixed in Firefox 149.0.2. The reference does not provide a reliable publication date, so the event date is left uncertain.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla released security updates to address vulnerabilities in multiple Firefox products, including **Firefox 152**, **Firefox for iOS 152.0**, **Firefox ESR 140.12**, and **Firefox ESR 115.37**. The fixes were published through Mozilla Foundation Security Advisories **`MFSA 2026-56`** through **`MFSA 2026-59`**, with the Firefox for iOS update specifically covered in **`MFSA 2026-56`**. The Canadian Centre for Cyber Security issued alert **`AV26-604`** highlighting the advisories and warning that systems running versions prior to those releases remain affected. The agency urged users and administrators to review Mozilla’s guidance and apply the updates needed to remediate the disclosed flaws across supported desktop, mobile, and extended support browser versions.
Jun 30, 2026
Mozilla released **Firefox 156** and **Firefox ESR 153.3** to address security vulnerabilities in its browser products. The Canadian Centre for Cyber Security advisory `AV26-924` identifies Firefox versions earlier than 156 and Firefox ESR versions earlier than **115.41**, **140.16**, and **153.3** as affected. Organizations should update standard Firefox deployments to version 156 and move ESR deployments to the applicable fixed release—115.41, 140.16, or 153.3. Administrators should review Mozilla’s associated security advisories, including `MFSA-2026-90` and `MFSA-2026-93`, and prioritize remediation across managed endpoints.
Sep 22, 2026
Mozilla released security advisories addressing vulnerabilities in **Firefox** and **Firefox ESR**, prompting the Canadian Centre for Cyber Security to urge organizations and users to apply updates. The affected versions included Firefox releases prior to `149`, Firefox ESR releases prior to `115.34`, and Firefox ESR releases prior to `140.9`, according to the earlier advisory. A subsequent Mozilla advisory issued additional fixes for the same product lines, affecting Firefox versions prior to `149.0.2`, Firefox ESR versions prior to `115.34.1`, and Firefox ESR versions prior to `140.9.1`. The Canadian Centre for Cyber Security described the notices as vendor patch and mitigation guidance and advised administrators to review Mozilla’s bulletins and deploy the necessary updates across exposed systems.
Jun 29, 2026