Loading story…
Mozilla revoked and replaced a GPG signing subkey used for certain Firefox and Thunderbird release artifacts after an unencrypted copy of the previous private subkey was accidentally committed to a private GitHub repository. The exposed key had been used to sign Linux tarballs, RPM packages, and checksum files. Mozilla said its review found no evidence of unauthorized access while the key was in the repository, noting that access was limited to a small internal group that already had authorized access by other means.
The company published a new signing key, issued a revocation for the old one, and said it has added safeguards to prevent a similar incident. Mozilla said most users do not need to take action, but users who manually verify GPG signatures must import the new key and the revocation certificate. Some Firefox RPM users may also need manual remediation because certain package managers do not automatically replace revoked keys, and Mozilla provided distro-specific guidance for Fedora, RHEL, Rocky, AlmaLinux, and openSUSE/SUSE systems.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Mozilla rotated to a new GPG signing subkey for affected Firefox and Thunderbird artifacts, including Linux tarballs, RPM packages, and checksum files, and revoked the previous signing key. Mozilla also said it added safeguards to prevent similar key-handling issues in the future.
After reviewing available audit records, Mozilla said it found no evidence that any unauthorized party accessed the signing key while it was present in the private repository.
Mozilla said an unencrypted copy of the previous GPG signing subkey for certain Firefox and Thunderbird release artifacts was inadvertently committed to a private GitHub repository. The repository was accessible only to a small internal group that already had authorized access to the key by other means.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
10 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourceopennet.me
Open sourceopennet.ru
Open sourceblog.mozilla.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla released security updates for **Firefox 154**, supported **Firefox ESR** branches, and **Thunderbird** to fix a broad set of vulnerabilities affecting desktop and mobile users. Government and vendor advisories said the updates address **3 critical** and **17 high-severity** flaws involving arbitrary code execution, privilege escalation, security restriction bypass, sandbox escape, site isolation failures, use-after-free conditions, and information disclosure. Firefox 154 also introduced product changes including expanded Local Access Network protections for WebSocket connections, while security notices from Canada and Italy urged organizations to review Mozilla bulletins and update affected installations. Tenable and downstream Linux advisories flagged the issue set as **critical** across Windows, macOS, and Slackware packages, with affected versions including Firefox releases prior to 154, multiple ESR builds before their patched versions, and Thunderbird releases prior to **140.14** or **154.0** depending on branch. Nessus coverage tied the fixes to numerous CVEs, including **`CVE-2026-74990`** as a scoring reference in several advisories, and highlighted specific Thunderbird issues such as a Remote Settings Client sandbox escape, a CanvasWebGL site isolation flaw, a DOM: Networking privilege escalation bug, and WebAssembly and garbage-collection use-after-free vulnerabilities. The recommended action across all notices was to upgrade Mozilla products to the latest patched versions immediately.
Aug 26, 2026
Mozilla disclosed and patched two high-severity vulnerability groups, **`CVE-2026-5731`** and **`CVE-2026-6786`**, affecting multiple Firefox and Thunderbird release lines. The flaws were described as memory safety bugs with evidence of memory corruption that could potentially be exploited for **arbitrary code execution**. Affected versions included Firefox earlier than **149.0.2** and **150**, Firefox ESR earlier than **115.34.1**, **140.9.1**, and **140.10**, plus corresponding Thunderbird and Thunderbird ESR releases. The fixes were shipped across standard and ESR channels in **Firefox 149.0.2**, **Firefox 150**, **Firefox ESR 115.34.1**, **Firefox ESR 140.9.1**, **Firefox ESR 140.10**, **Thunderbird 149.0.2**, **Thunderbird 150**, and **Thunderbird ESR 140.9.1/140.10**. The CVE records link the issues to memory-corruption weaknesses including **`CWE-119`**, **`CWE-125`**, **`CWE-787`**, and **`CWE-416`**, and assign high-impact CVSS vectors reflecting potential compromise of confidentiality, integrity, and availability if exploited.
Jun 29, 2026
Mozilla released **Firefox 150** and updated **Firefox ESR** branches to address multiple security vulnerabilities, prompting downstream advisories from Debian and the Canadian Centre for Cyber Security. The fixes cover Firefox versions prior to `150`, Firefox ESR versions prior to `140.10` and `115.35`, and include vulnerabilities tracked as **CVE-2026-6768**, **CVE-2026-6784**, **CVE-2026-6785**, and **CVE-2026-6786**. **CVE-2026-6768** was described as a mitigation bypass in Firefox’s `Networking: Cookies` component and was assigned a **CVSS 9.8** score, indicating potentially severe impact if left unpatched. Mozilla also shipped related security fixes in **Thunderbird 150**, which uses Firefox’s web engine and addressed issues including a clickjacking and information disclosure flaw referenced in the Firefox advisories. Alongside the security patches, Mozilla’s releases included broad product updates such as privacy and platform changes in Firefox and improved encrypted-message search and OpenPGP features in Thunderbird. Government and Linux distribution advisories urged users and administrators to review Mozilla’s bulletins and apply the latest browser and mail client updates promptly.
Jun 29, 2026