PatchFirst · Latest vulnerabilities

firefox-esr vulnerabilities · Page 14

Vulnerabilities published for firefox-esr in the last 30 days: 206. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1349

CVE-2026-100766
Medium · CVSS 4.3EPSS 0.25%Fix available
Information disclosure in the Networking: JAR component
Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100765
High · CVSS 8.8EPSS 0.29%Fix available
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100762
Critical · CVSS 9.6EPSS 0.32%Fix available
Sandbox escape due to use-after-free in the DOM: Content Processes component
Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100760
Critical · CVSS 9.6EPSS 0.3%Fix available
Sandbox escape in the Security: Process Sandboxing component
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100759
High · CVSS 8.1EPSS 0.31%Fix available
Uninitialized memory in the Storage: Quota Manager component
Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated October 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100758
Critical · CVSS 9.6EPSS 0.3%Fix available
Sandbox escape in the DOM: Navigation component
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100757
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the Widget component
Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-100756
High · CVSS 8.1EPSS 0.31%Fix available
Incorrect boundary conditions in the Audio/Video: Playback component
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
firefox-esr Operating systems
- Update to 153.4.0esr-1
Published September 29, 2026Updated September 30, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92032
Critical · CVSS 9.6EPSS 0.32%Fix available
Sandbox escape due to invalid pointer in the Graphics component
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92031
Medium · CVSS 6.5EPSS 0.31%Fix available
Information disclosure in the Graphics: ImageLib component
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92030
Medium · CVSS 5.4EPSS 0.22%Fix available
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92029
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 20, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92028
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 20, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92027
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the DOM: Streams component
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92026
High · CVSS 8.8EPSS 0.31%Fix available
Use-after-free in the Networking component
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92025
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the DOM: Navigation component
Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92024
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 20, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92023
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the XML component
Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 20, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92022
High · CVSS 8.8EPSS 0.32%Fix available
Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 20, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-92021
High · CVSS 8.8EPSS 0.28%Fix available
Use-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
firefox-esr Operating systems
- Update to 140.16.0esr-1
Published September 15, 2026Updated September 20, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

firefox-esr vulnerabilities · Page 14

Information disclosure in the Networking: JAR component

Use-after-free in the JavaScript: WebAssembly component

Sandbox escape due to use-after-free in the DOM: Content Processes component

Sandbox escape in the Security: Process Sandboxing component

Uninitialized memory in the Storage: Quota Manager component

Sandbox escape in the DOM: Navigation component

Use-after-free in the Widget component

Incorrect boundary conditions in the Audio/Video: Playback component

Sandbox escape due to invalid pointer in the Graphics component

Information disclosure in the Graphics: ImageLib component

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

Use-after-free in the SVG component

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Streams component

Use-after-free in the Networking component

Use-after-free in the DOM: Navigation component

Use-after-free in the SVG component

Use-after-free in the XML component

Use-after-free in the DOM: HTML Parser component

Use-after-free in the JavaScript Engine: JIT component

Check your server