PatchFirst · Latest vulnerabilities

firefox-esr vulnerabilities · Page 4

Vulnerabilities published for firefox-esr in the last 30 days: 124. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1214

CVE-2026-109710
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the Graphics: Text component
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-109706
Medium · CVSS 5.4EPSS 0.23%Fix available
Use-after-free in the Storage: IndexedDB component
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
firefox-esr Operating systems
- Update to 153.5.0esr-1~deb13u1
Published October 13, 2026Updated October 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100832
High · CVSS 8.8EPSS 0.24%Fix available
Use-after-free in the Graphics: Canvas2D component
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100831
High · CVSS 8.8EPSS 0.24%Fix available
Use-after-free in the DOM: UI Events & Focus Handling component
Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100830
High · CVSS 8.1EPSS 0.14%Fix available
Mitigation bypass in the DOM: Navigation component
Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100829
Critical · CVSS 9.6EPSS 0.24%Fix available
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100828
Critical · CVSS 9.6EPSS 0.24%Fix available
Mitigation bypass in the Bookmarks & History component
Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100826
Medium · CVSS 6.5EPSS 0.22%Fix available
Denial-of-service in the Storage: StorageManager component
Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100825
High · CVSS 8.8EPSS 0.23%Fix available
Use-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100824
High · CVSS 8.8EPSS 0.22%Fix available
Privilege escalation in the Places component
Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100822
Medium · CVSS 5.4EPSS 0.28%Fix available
Spoofing issue in the Networking: HTTP component
Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100821
Medium · CVSS 4.7EPSS 0.14%Fix available
Site isolation issue in the Panning and Zooming component
Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100820
High · CVSS 8.8EPSS 0.24%Fix available
Privilege escalation in the Address Bar component
Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100819
Critical · CVSS 9.6EPSS 0.26%Fix available
Sandbox escape due to incorrect boundary conditions in the XPCOM component
Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100818
Critical · CVSS 9.6EPSS 0.27%Fix available
Sandbox escape due to use-after-free in the Widget: Gtk component
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100816
High · CVSS 8.1EPSS 0.15%Fix available
Site isolation issue in the DOM: Networking component
Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100815
High · CVSS 8.8EPSS 0.24%Fix available
Use-after-free in the CSS Parsing and Computation component
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100814
High · CVSS 8.8EPSS 0.24%Fix available
Incorrect boundary conditions in the JavaScript Engine: JIT component
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100812
Medium · CVSS 6.5EPSS 0.27%Fix available
Denial-of-service in the Graphics component
Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100811
Critical · CVSS 9.6EPSS 0.27%Fix available
Sandbox escape due to use-after-free in the DOM: Core & HTML component
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

firefox-esr vulnerabilities · Page 4

Use-after-free in the Graphics: Text component

Use-after-free in the Storage: IndexedDB component

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the DOM: UI Events & Focus Handling component

Mitigation bypass in the DOM: Navigation component

Mitigation bypass in the DOM: Security component

Mitigation bypass in the Bookmarks & History component

Denial-of-service in the Storage: StorageManager component

Use-after-free in the JavaScript Engine: JIT component

Privilege escalation in the Places component

Spoofing issue in the Networking: HTTP component

Site isolation issue in the Panning and Zooming component

Privilege escalation in the Address Bar component

Sandbox escape due to incorrect boundary conditions in the XPCOM component

Sandbox escape due to use-after-free in the Widget: Gtk component

Site isolation issue in the DOM: Networking component

Use-after-free in the CSS Parsing and Computation component

Incorrect boundary conditions in the JavaScript Engine: JIT component

Denial-of-service in the Graphics component

Sandbox escape due to use-after-free in the DOM: Core & HTML component

Check your server