endpoint-software-vulnerabilitywidely-deployed-product-advisory

Mozilla Patches Critical Firefox Memory Safety and Security Mitigation Bypass Flaws

Vulnerability Disclosure · 2 sources · Updated 3d ago · First seen Jul 22, 2026

Mozilla released Firefox 153, Firefox ESR 140.13, and Firefox ESR 115.38 to address multiple security vulnerabilities, according to an EG-FinCIRT advisory published July 22. The advisory highlights CVE-2026-16361, a memory safety vulnerability rated CVSS 9.8 that could enable remote code execution, and CVE-2026-16394, a DOM security mitigation bypass rated CVSS 9.1.

The advisory describes both highlighted flaws as remotely exploitable with low attack complexity, no privileges, and no user interaction. Organizations should prioritize testing and deploying the applicable Firefox and ESR updates across managed endpoints; EG-FinCIRT recommends installation as soon as testing is complete.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 22, 2026

Reported Jul 22, 20263mo ago
Mozilla releases security fixes for Firefox and ESR branches
Mozilla released Firefox 153, Firefox ESR 140.13, and Firefox ESR 115.38 to address multiple security vulnerabilities, including flaws that could enable arbitrary code execution, security bypass, and information disclosure.
Mozilla Firefox Security Updates - 22 July 2026 - EG-FinCIRT
Jul 22, 20263mo ago
EG-FinCIRT issues critical advisory on Firefox vulnerabilities
EG-FinCIRT highlighted CVE-2026-16361, a memory safety vulnerability with a reported CVSS score of 9.8, and CVE-2026-16394, a DOM security mitigation bypass rated 9.1. The advisory described both as remotely exploitable without privileges or user interaction and recommended deploying patches after testing.
Mozilla Firefox Security Updates - 22 July 2026 - EG-FinCIRT

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

DOM Security Mitigation Bypass in Mozilla Firefox and Thunderbird (CVE-2026-16394)Memory Safety Vulnerabilities in Firefox ESR and Thunderbird (CVE-2026-16361)

Affected products

2 linked

Firefox EsrFirefox

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Egfincirt BlogNews · Jul 22, 2026

Mozilla Firefox Security Updates - 22 July 2026 - EG-FinCIRTOpen source ↗

Egfincirt BlogNews · Jul 22, 2026

Mozilla Firefox Security Updates - 22 July 2026 - EG-FinCIRTOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Mozilla Patches Critical Firefox Memory Safety and Security Mitigation Bypass Flaws

How this story unfolded

Mozilla releases security fixes for Firefox and ESR branches

EG-FinCIRT issues critical advisory on Firefox vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

Mozilla Ships Critical Firefox and Firefox ESR Security Fixes

Mozilla fixes memory safety flaws in Firefox and Thunderbird with RCE risk

Mozilla Patches Critical Firefox Memory Safety and Security Mitigation Bypass Flaws

How this story unfolded

Mozilla releases security fixes for Firefox and ESR branches

EG-FinCIRT issues critical advisory on Firefox vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple High-Impact Vulnerabilities Patched in Firefox ESR 140.6

Mozilla Ships Critical Firefox and Firefox ESR Security Fixes

Mozilla fixes memory safety flaws in Firefox and Thunderbird with RCE risk