PatchFirst · Latest vulnerabilities

firefox-esr vulnerabilities · Page 3

Vulnerabilities published for firefox-esr in the last 30 days: 124. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1214

CVE-2026-109709
High · CVSS 8.8EPSS 0.33%Fix available
Information disclosure, privilege escalation in the Security: Process Sandboxing component
Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 14, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109708
Critical · CVSS 9.6EPSS 0.32%Fix available
Sandbox escape due to incorrect boundary conditions in the Networking component
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109707
Critical · CVSS 9.6EPSS 0.31%Fix available
Sandbox escape due to use-after-free in the Networking component
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109705
Critical · CVSS 9.6EPSS 0.31%Fix available
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109704
High · CVSS 8.8EPSS 0.41%No fix published
Privilege escalation in the Application Update component
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
Published October 13, 2026Updated October 14, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109753
High · CVSS 8.1EPSS 0.34%Fix available
Incorrect boundary conditions in the Layout component
Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109733
High · CVSS 8.1EPSS 0.46%Fix available
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109732
Medium · CVSS 5.4EPSS 0.24%Fix available
Use-after-free in the DOM: Streams component
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109730
High · CVSS 8.8EPSS 0.36%Fix available
Integer overflow in the Graphics component
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109729
Medium · CVSS 5.4EPSS 0.24%Fix available
Use-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109728
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the DOM: Animation component
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109727
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the Audio/Video component
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109726
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109725
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109722
High · CVSS 8.1EPSS 0.31%Fix available
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109719
Medium · CVSS 4.2EPSS 0.17%Fix available
Race condition, use-after-free in the Graphics: CanvasWebGL component
Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109718
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the XML component
Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109716
High · CVSS 8.1EPSS 0.31%Fix available
Incorrect boundary conditions in the JavaScript Engine component
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109715
High · CVSS 8.1EPSS 0.31%Fix available
Incorrect boundary conditions in the JavaScript Engine component
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109712
High · CVSS 7.1EPSS 0.22%Fix available
Sandbox escape due to uninitialized memory in the Graphics component
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

firefox-esr vulnerabilities · Page 3

Information disclosure, privilege escalation in the Security: Process Sandboxing component

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape due to use-after-free in the Networking component

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

Privilege escalation in the Application Update component

Incorrect boundary conditions in the Layout component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the DOM: Streams component

Integer overflow in the Graphics component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the DOM: Animation component

Use-after-free in the Audio/Video component

Use-after-free in the SVG component

Use-after-free in the DOM: Core & HTML component

JIT miscompilation in the JavaScript Engine: JIT component

Race condition, use-after-free in the Graphics: CanvasWebGL component

Use-after-free in the XML component

Incorrect boundary conditions in the JavaScript Engine component

Incorrect boundary conditions in the JavaScript Engine component

Sandbox escape due to uninitialized memory in the Graphics component

Check your server