Vulnerabilities · 1 day ago
Mozilla patch bundle spans Firefox and Thunderbird tracks Mozilla shipped security updates for Firefox, Firefox ESR, and Thunderbird that fix 30 high-severity flaws, with release and extended-support branches both included. CSIRT Italia said the affected builds are Firefox 158, Firefox ESR 115.43 and 153.5, and Thunderbird 158 and 153.5.
Some of the fixes land on the release line, some on ESR, and some on both, so the installed track matters as much as the product name. In a managed fleet that mixes Firefox and Thunderbird channels, patching one branch does not make the others safe; an endpoint can still sit on a vulnerable version until the matching update lands.
The exposure is version- and channel-specific, so mixed fleets need the right fix on the right branch rather than a single blanket version check.
CVEs in this update
51 CVEs
Across Firefox ESR, Thunderbird, Firefox.
2 critical · 2 high · 23 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-109707 · 9.6 CRITICAL
Showing the top 10 by KEV, EPSS, and severity.
Timeline Sources 2 sources covering this story
CSIRT Italia / ACN Oct 13
Risolte vulnerabilità in prodotti Mozilla
Aggiornamenti di sicurezza sanano molteplici vulnerabilità di sicurezza, di cui 30 con gravità “alta”, in Firefox e Firefox ESR.
CVE Program records Oct 13
Mitigation bypass in the File Handling component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Mitigation bypass in the DOM: Core & HTML component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Privilege escalation in the WebExtensions component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the Storage: IndexedDB component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the WebRTC: Networking component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Spoofing issue in the DOM: Web Serial component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the Networking: Cache component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the Networking component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Mitigation bypass in the Enterprise Policies component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Race condition, use-after-free in the Graphics: Text component
Affected products: Mozilla Firefox, Mozilla Thu
CVE Program records Oct 13
Mitigation bypass in the Enterprise Policies component
Affected products: Mozilla Firefox, Mozilla Thunderbird
Entities CVE-2026-109706 CVE-2026-109707 CVE-2026-109710 CVE-2026-109711 Part of the PlainSec briefing for 2026-10-14
Editions Related stories Vulnerabilities · 1 day ago
Mozilla patch bundle spans Firefox and Thunderbird tracks Mozilla shipped security updates for Firefox, Firefox ESR, and Thunderbird that fix 30 high-severity flaws, with release and extended-support branches both included. CSIRT Italia said the affected builds are Firefox 158, Firefox ESR 115.43 and 153.5, and Thunderbird 158 and 153.5.
Some of the fixes land on the release line, some on ESR, and some on both, so the installed track matters as much as the product name. In a managed fleet that mixes Firefox and Thunderbird channels, patching one branch does not make the others safe; an endpoint can still sit on a vulnerable version until the matching update lands.
The exposure is version- and channel-specific, so mixed fleets need the right fix on the right branch rather than a single blanket version check.
CVEs in this update
51 CVEs
Across Firefox ESR, Thunderbird, Firefox.
2 critical · 2 high · 23 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-109707 · 9.6 CRITICAL
Showing the top 10 by KEV, EPSS, and severity.
Timeline Sources 2 sources covering this story
CSIRT Italia / ACN Oct 13
Risolte vulnerabilità in prodotti Mozilla
Aggiornamenti di sicurezza sanano molteplici vulnerabilità di sicurezza, di cui 30 con gravità “alta”, in Firefox e Firefox ESR.
CVE Program records Oct 13
Mitigation bypass in the File Handling component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Mitigation bypass in the DOM: Core & HTML component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Privilege escalation in the WebExtensions component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the Storage: IndexedDB component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the WebRTC: Networking component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Spoofing issue in the DOM: Web Serial component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the Networking: Cache component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Information disclosure in the Networking component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Mitigation bypass in the Enterprise Policies component
Affected products: Mozilla Firefox, Mozilla Thunderbird
CVE Program records Oct 13
Race condition, use-after-free in the Graphics: Text component
Affected products: Mozilla Firefox, Mozilla Thu
CVE Program records Oct 13
Mitigation bypass in the Enterprise Policies component
Affected products: Mozilla Firefox, Mozilla Thunderbird
Entities CVE-2026-109706 CVE-2026-109707 CVE-2026-109710 CVE-2026-109711 Part of the PlainSec briefing for 2026-10-14
Editions Related stories