Vulnerabilities & Exploits
Mozilla patch bundle spans Firefox and Thunderbird tracks Mozilla shipped security updates for Firefox, Firefox ESR, and Thunderbird that fix 30 high-severity flaws, with release and extended-support branches both included. CSIRT Italia said the affected builds are Firefox 158, Firefox ESR 115.43 and 153.5, and Thunderbird 158 and 153.5.
Some of the fixes land on the release line, some on ESR, and some on both, so the installed track matters as much as the product name. In a managed fleet that mixes Firefox and Thunderbird channels, patching one branch does not make the others safe; an endpoint can still sit on a vulnerable version until the matching update lands.
The exposure is version- and channel-specific, so mixed fleets need the right fix on the right branch rather than a single blanket version check.
2 sources · 1 day ago
CVEs in this update
51 CVEs
Across Firefox ESR, Thunderbird, Firefox.
2 critical · 2 high · 23 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-109707 · 9.6 CRITICAL
Showing the top 10 by KEV, EPSS, and severity.
Timeline Sources Oct 13 CSIRT Italia / ACN
Risolte vulnerabilità in prodotti Mozilla
Aggiornamenti di sicurezza sanano molteplici vulnerabilità di sicurezza, di cui 30 con gravità “alta”, in Firefox e Firefox ESR.
original Oct 13 CVE Program records
Mitigation bypass in the File Handling component
Affected products: Mozilla Firefox, Mozilla Thunderbird
original Oct 13 CVE Program records
Mitigation bypass in the DOM: Core & HTML component
original Part of the PlainSec briefing for 2026-10-14
Every edition of this story: Mozilla patch bundle spans Firefox and Thunderbird tracks
More from today Vulnerabilities & Exploits
Mozilla patch bundle spans Firefox and Thunderbird tracks Mozilla shipped security updates for Firefox, Firefox ESR, and Thunderbird that fix 30 high-severity flaws, with release and extended-support branches both included. CSIRT Italia said the affected builds are Firefox 158, Firefox ESR 115.43 and 153.5, and Thunderbird 158 and 153.5.
Some of the fixes land on the release line, some on ESR, and some on both, so the installed track matters as much as the product name. In a managed fleet that mixes Firefox and Thunderbird channels, patching one branch does not make the others safe; an endpoint can still sit on a vulnerable version until the matching update lands.
The exposure is version- and channel-specific, so mixed fleets need the right fix on the right branch rather than a single blanket version check.
2 sources · 1 day ago
CVEs in this update
51 CVEs
Across Firefox ESR, Thunderbird, Firefox.
2 critical · 2 high · 23 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-109707 · 9.6 CRITICAL
Showing the top 10 by KEV, EPSS, and severity.
Timeline Sources Oct 13 CSIRT Italia / ACN
Risolte vulnerabilità in prodotti Mozilla
Aggiornamenti di sicurezza sanano molteplici vulnerabilità di sicurezza, di cui 30 con gravità “alta”, in Firefox e Firefox ESR.
original Oct 13 CVE Program records
Mitigation bypass in the File Handling component
Affected products: Mozilla Firefox, Mozilla Thunderbird
original Oct 13 CVE Program records
Mitigation bypass in the DOM: Core & HTML component
original Part of the PlainSec briefing for 2026-10-14
Every edition of this story: Mozilla patch bundle spans Firefox and Thunderbird tracks
More from today