PatchFirst · Latest vulnerabilities

firefox-esr vulnerabilities · Page 2

Vulnerabilities published for firefox-esr in the last 30 days: 124. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1214

CVE-2026-109752
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the DOM: Workers component
Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109751
Medium · CVSS 4.3EPSS 0.26%Fix available
Information disclosure in the Networking component
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109745
Critical · CVSS 9.6EPSS 0.35%Fix available
Sandbox escape due to uninitialized memory in the DOM: Web Serial component
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109744
High · CVSS 8.1EPSS 0.32%Fix available
Other issue in the DOM: File component
Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109743
High · CVSS 8.8EPSS 0.35%Fix available
Privilege escalation in the Panning and Zooming component
Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 14, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109742
Medium · CVSS 4.3EPSS 0.26%Fix available
Information disclosure in the PDF Viewer component
Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109741
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the Storage: Bucket File System component
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109740
Critical · CVSS 9.6EPSS 0.35%No fix published
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109738
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the Audio/Video: Playback component
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109737
High · CVSS 8.1EPSS 0.34%Fix available
Mitigation bypass in the Enterprise Policies component
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109736
High · CVSS 8.1EPSS 0.32%Fix available
Frame poisoning in the Layout component
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109734
High · CVSS 8.1EPSS 0.34%Fix available
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109731
Medium · CVSS 5.4EPSS 0.23%Fix available
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109724
Medium · CVSS 5.4EPSS 0.22%Fix available
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109723
Medium · CVSS 5.4EPSS 0.22%Fix available
Integer overflow in the Layout: Text and Fonts component
Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109721
Medium · CVSS 5.4EPSS 0.28%Fix available
Incorrect boundary conditions in the JavaScript Engine: JIT component
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109720
High · CVSS 7.1EPSS 0.26%Fix available
JIT miscompilation in the JavaScript: WebAssembly component
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109717
Medium · CVSS 5.4EPSS 0.22%Fix available
Use-after-free in the DOM: Bindings (WebIDL) component
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109713
Medium · CVSS 5.4EPSS 0.22%Fix available
Use-after-free in the Crash Reporting component
Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109711
Medium · CVSS 5.4EPSS 0.22%Fix available
Use-after-free in the Graphics: Canvas2D component
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

firefox-esr vulnerabilities · Page 2

Use-after-free in the DOM: Workers component

Information disclosure in the Networking component

Sandbox escape due to uninitialized memory in the DOM: Web Serial component

Other issue in the DOM: File component

Privilege escalation in the Panning and Zooming component

Information disclosure in the PDF Viewer component

Use-after-free in the Storage: Bucket File System component

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Use-after-free in the Audio/Video: Playback component

Mitigation bypass in the Enterprise Policies component

Frame poisoning in the Layout component

Mitigation bypass in the DOM: Security component

Incorrect boundary conditions in the Graphics: Canvas2D component

Use-after-free in the DOM: Core & HTML component

Integer overflow in the Layout: Text and Fonts component

Incorrect boundary conditions in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript: WebAssembly component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the Crash Reporting component

Use-after-free in the Graphics: Canvas2D component

Check your server