Loading story…
Mozilla released Firefox 152 for desktop and web platforms alongside Firefox ESR 140.12.0 and 115.37.0, delivering browser, developer, and mobile updates that include experimental JPEG XL support in Firefox Labs, changes to the Notifications and Pointer Lock APIs, CSS field-sizing, PDF handling improvements, and new Android features such as AI-assisted tab grouping and enhanced link-sharing options.
The release also fixes 77 security vulnerabilities, with Mozilla stating that 60 were memory-safety bugs and that some could potentially be exploited for arbitrary code execution when processing specially crafted content. The patched issues include groups tracked as CVE-2026-12328, CVE-2026-12327, and CVE-2026-12326, making the update a significant security release for both standard and ESR Firefox users.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
As part of the Firefox 152 release, Mozilla fixed 77 security vulnerabilities, including issues tracked as CVE-2026-12328, CVE-2026-12327, and CVE-2026-12326. Mozilla said 60 of the fixed flaws were memory-safety bugs, some potentially exploitable for arbitrary code execution via specially crafted content.
Mozilla released Firefox 152 along with Firefox ESR 140.12.0 and 115.37.0 for desktop and web platforms. The release introduced multiple browser and developer-facing changes, including experimental JPEG XL support and API, CSS, PDF, and Android updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcemozilla.org
Open sourcebugzilla.mozilla.org
Open sourcedeveloper.mozilla.org
Open sourcedeveloper.mozilla.org
Open sourceopennet.ru
Open sourceopennet.me
Open sourcedeveloper.mozilla.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla released **Firefox 155** and maintenance updates for Firefox ESR 153.2.0, 140.15.0, and 115.40.0. The release remediates **109 security vulnerabilities**, including memory-safety issues that malicious websites could potentially exploit for arbitrary code execution or other browser compromise; organizations should prioritize deployment across managed Firefox installations. Firefox 155 also introduces an experimental AI-assisted “Smart Window” feature for a limited user set, alongside web-platform, developer-tool, PDF viewer, Android, HTTP/3, WebAssembly, CSS, JSON, WebTransport, and Windows controller updates. Several experimental platform capabilities remain disabled by default and can be enabled through `about:config`; the release also changes captive-portal detection from `detectportal.firefox.com` to `firefox-portal-detection.com`.
Sep 5, 2026
Mozilla released **Firefox 157** with fixes for 76 vulnerabilities, including 38 rated high severity. The high-severity issues include memory-safety flaws that could allow attacker-controlled code execution if a user opens a specially crafted web page; Mozilla reported no vulnerabilities rated critical and the available advisories do not identify active exploitation. Mozilla also issued security updates for **Firefox ESR 153.4.0, 140.17.0, and 115.42.0**. Users and administrators running earlier Firefox or ESR versions should upgrade promptly. Firefox 157 additionally introduces the experimental Nova sidebar interface, enables AV1 screen sharing support in WebRTC, and includes CSS and JavaScript dialog improvements.
Sep 29, 2026
Mozilla released Firefox ESR 140.6 to address several high and moderate impact security vulnerabilities, including use-after-free, sandbox escape, privilege escalation, JIT miscompilation, and same-origin policy bypass issues. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation flaws in the DOM: Notifications and Netmonitor components. Several JIT miscompilation bugs in the JavaScript Engine were also patched, which could potentially allow attackers to execute arbitrary code. Additionally, memory safety bugs affecting previous versions of Firefox ESR, Thunderbird, and Firefox were resolved, with some showing evidence of memory corruption that could be exploited. Mozilla recommends updating to Firefox ESR 140.6 to mitigate these risks and ensure systems are protected against these vulnerabilities.
Jun 29, 2026