Mozilla fixes critical flaws in Firefox, ESR, and Thunderbird

Mozilla released security updates for Firefox 154, supported Firefox ESR branches, and Thunderbird to fix a broad set of vulnerabilities affecting desktop and mobile users. Government and vendor advisories said the updates address 3 critical and 17 high-severity flaws involving arbitrary code execution, privilege escalation, security restriction bypass, sandbox escape, site isolation failures, use-after-free conditions, and information disclosure. Firefox 154 also introduced product changes including expanded Local Access Network protections for WebSocket connections, while security notices from Canada and Italy urged organizations to review Mozilla bulletins and update affected installations.

Tenable and downstream Linux advisories flagged the issue set as critical across Windows, macOS, and Slackware packages, with affected versions including Firefox releases prior to 154, multiple ESR builds before their patched versions, and Thunderbird releases prior to 140.14 or 154.0 depending on branch. Nessus coverage tied the fixes to numerous CVEs, including CVE-2026-74990 as a scoring reference in several advisories, and highlighted specific Thunderbird issues such as a Remote Settings Client sandbox escape, a CanvasWebGL site isolation flaw, a DOM: Networking privilege escalation bug, and WebAssembly and garbage-collection use-after-free vulnerabilities. The recommended action across all notices was to upgrade Mozilla products to the latest patched versions immediately.