PatchFirst · Latest vulnerabilities

firefox-esr vulnerabilities · Page 5

Vulnerabilities published for firefox-esr in the last 30 days: 124. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1214

CVE-2026-100809
High · CVSS 8.1EPSS 0.15%Fix available
Same-origin policy bypass in the DevTools component
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100808
High · CVSS 8.8EPSS 0.3%Fix available
Mitigation bypass in the DOM: Service Workers component
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100807
High · CVSS 8.8EPSS 0.23%Fix available
Privilege escalation in the DOM: Service Workers component
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100806
Medium · CVSS 4.3EPSS 0.25%Fix available
Uninitialized memory in the Graphics: WebGPU component
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100803
High · CVSS 8.1EPSS 0.17%Fix available
Same-origin policy bypass in the WebExtensions component
Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100801
High · CVSS 8.8EPSS 0.23%Fix available
Privilege escalation in the DLL Services component
Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100800
Critical · CVSS 9.6EPSS 0.29%Fix available
Sandbox escape due to use-after-free in the Disability Access APIs component
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100798
High · CVSS 8.1EPSS 0.19%Fix available
Cryptography misuse in Storage: Quota Manager component
Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100797
High · CVSS 8.8EPSS 0.25%Fix available
Privilege escalation due to use-after-free in the Graphics: WebRender component
Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-96869
Medium · CVSS 4.3EPSS 0.24%Fix available
Information disclosure in the Networking component
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100794
Critical · CVSS 9.6EPSS 0.32%Fix available
Sandbox escape due to incorrect boundary conditions in the Internationalization component
Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100792
High · CVSS 7.1EPSS 0.26%Fix available
JIT miscompilation in the JavaScript: WebAssembly component
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100791
High · CVSS 8.8EPSS 0.4%Fix available
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100790
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the XSLT component
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100789
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the Graphics: Canvas2D component
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100788
Critical · CVSS 9.8EPSS 0.41%Fix available
Invalid pointer in the JavaScript: WebAssembly component
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100787
Critical · CVSS 9.6EPSS 0.3%Fix available
Sandbox escape in the XUL component
Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100786
Critical · CVSS 9.6EPSS 0.32%Fix available
Sandbox escape due to use-after-free in the Graphics component
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100785
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100784
High · CVSS 8.8EPSS 0.33%Fix available
Use-after-free in the Layout: Text and Fonts component
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1~deb13u1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

firefox-esr vulnerabilities · Page 5

Same-origin policy bypass in the DevTools component

Mitigation bypass in the DOM: Service Workers component

Privilege escalation in the DOM: Service Workers component

Uninitialized memory in the Graphics: WebGPU component

Same-origin policy bypass in the WebExtensions component

Privilege escalation in the DLL Services component

Sandbox escape due to use-after-free in the Disability Access APIs component

Cryptography misuse in Storage: Quota Manager component

Privilege escalation due to use-after-free in the Graphics: WebRender component

Information disclosure in the Networking component

Sandbox escape due to incorrect boundary conditions in the Internationalization component

JIT miscompilation in the JavaScript: WebAssembly component

Use-after-free in the DOM: Core & HTML component

Use-after-free in the XSLT component

Use-after-free in the Graphics: Canvas2D component

Invalid pointer in the JavaScript: WebAssembly component

Sandbox escape in the XUL component

Sandbox escape due to use-after-free in the Graphics component

Use-after-free in the DOM: Core & HTML component

Use-after-free in the Layout: Text and Fonts component

Check your server