Description
Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Firefox | — | 140.14 |
| Mozilla | Thunderbird | — | 140.14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 140.14.0esr-2 | — |
| Debian 14 | thunderbird | 1:140.14.0esr-1 | — |
| Debian 13 | firefox-esr | 140.14.0esr-1~deb13u1 | — |
| Debian 13 | thunderbird | 1:140.14.0esr-1~deb13u1 | — |
| Debian 12 | firefox-esr | 140.14.0esr-1~deb12u1 | — |
| Debian 12 | thunderbird | 1:140.14.0esr-1~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | mozjs102 +1 | No fix yet | — |
| Ubuntu 22.04 LTS | mozjs78 +3 | No fix yet | — |
| Ubuntu 20.04 LTS | mozjs52 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | mozjs38 +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | firefox +1 | 140.14.0-1.el10_2 | RHSA-2026:65159, RHSA-2026:58899 |
| RHEL 9 | firefox +2 | 140.14.0-1.el9_8 | RHSA-2026:65158, RHSA-2026:58897 |
| RHEL 8 | firefox +1 | 140.14.0-1.el8_10 | RHSA-2026:65160, RHSA-2026:58898 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | firefox +1 | 140.14.0-1.el10_0 | RHSA-2026:65633, RHSA-2026:64813 |
| RHEL 9.6 EUS | firefox +2 | 140.14.0-1.el9_6 | RHSA-2026:65670, RHSA-2026:65103 |
| RHEL 9.4 E4S | firefox +2 | 140.14.0-1.el9_4 | RHSA-2026:65669, RHSA-2026:65105 |
| RHEL 9.2 E4S | firefox +2 | 140.14.0-1.el9_2 | RHSA-2026:65888, RHSA-2026:65766 |
| RHEL 8.8 TUS | firefox +1 | 140.14.0-1.el8_8 | RHSA-2026:65765, RHSA-2026:64814 |
| RHEL 8.8 E4S | firefox +1 | 140.14.0-1.el8_8 | RHSA-2026:65765, RHSA-2026:64814 |
| RHEL 8.6 EUS Long Life | firefox +1 | 140.14.0-1.el8_6 | RHSA-2026:65757, RHSA-2026:65110 |
| RHEL 8.6 AUS | firefox +1 | 140.14.0-1.el8_6 | RHSA-2026:65757, RHSA-2026:65110 |
| RHEL 8.4 EUS Long Life | firefox +1 | 140.14.0-1.el8_4 | RHSA-2026:65764, RHSA-2026:65111 |
| RHEL 8.4 AUS | firefox +1 | 140.14.0-1.el8_4 | RHSA-2026:65764, RHSA-2026:65111 |
| RHEL 7 ELS | firefox | 140.14.0-1.el7_9 | RHSA-2026:65442 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | firefox | 140.14.0-1.el10_2 | ALSA-2026:58899 |
| AlmaLinux 10 | thunderbird | 140.14.0-1.el10_2.alma.1 | ALSA-2026:65159 |
| AlmaLinux 9 | firefox +2 | 140.14.0-1.el9_8.alma.1 | ALSA-2026:65158, ALSA-2026:58897 |
| AlmaLinux 8 | firefox +1 | 140.14.0-1.el8_10.alma.1 | ALSA-2026:65160, ALSA-2026:58898 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | firefox +1 | 140.14.0-1.el10_2 | RLSA-2026:65159, RLSA-2026:58899 |
| Rocky Linux 9 | firefox +1 | 140.14.0-1.el9_8 | RLSA-2026:65158, RLSA-2026:58897 |
| Rocky Linux 8 | firefox +1 | 140.14.0-1.el8_10 | RLSA-2026:65160, RLSA-2026:58898 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLES 15 SP7 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP7 | MozillaThunderbird | 140.14.0-150200.8.283.1 | SUSE-SU-2026:4268-1, SUSE-SU-2026:3897-1 |
| SLES 15 SP7 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP7 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP6 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLES 15 SP6 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP6 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP6 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP5 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLES 15 SP5 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP5 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP5 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP4 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLES 15 SP4 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP4 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLES 15 SP4 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLES 12 SP5 | MozillaFirefox | 140.14.0-112.327.1 | SUSE-SU-2026:4140-1, SUSE-SU-2026:3683-1 |
| SLES 12 SP5 | MozillaFirefox-branding-SLE | 153-41.3.8 | SUSE-SU-2026:4140-1 |
| SLES 12 SP5 | mozilla-nspr | 4.39-19.39.1 | SUSE-SU-2026:4140-1 |
| SLES 12 SP5 | mozilla-nss | 3.125-58.147.1 | SUSE-SU-2026:4140-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | MozillaFirefox | 140.14.0-160000.1.1 | SUSE-SU-2026:23590-1, SUSE-SU-2026:23304-1 |
| SLES for SAP 16.0 | MozillaFirefox-branding-SLE | 153-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLES for SAP 16.0 | mozilla-nspr | 4.39-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLES for SAP 16.0 | mozilla-nss | 3.125-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLES for SAP 16.0 | rust-cbindgen | 0.29.4+git0-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLES for SAP 15 SP6 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLES for SAP 15 SP6 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP6 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP6 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP5 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLES for SAP 15 SP5 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP5 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP5 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP4 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLES for SAP 15 SP4 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP4 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLES for SAP 15 SP4 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLES 16.0 | MozillaFirefox | 140.14.0-160000.1.1 | SUSE-SU-2026:23590-1, SUSE-SU-2026:23304-1 |
| SLES 16.0 | MozillaFirefox-branding-SLE | 153-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLES 16.0 | mozilla-nspr | 4.39-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLES 16.0 | mozilla-nss | 3.125-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLES 16.0 | rust-cbindgen | 0.29.4+git0-160000.1.1 | SUSE-SU-2026:23590-1 |
| SLE Micro 6.2 | mozilla-nspr | 4.39-160000.1.1 | SUSE-SU-2026:23411-1 |
| SLE Micro 6.2 | mozilla-nss | 3.125-160000.1.1 | SUSE-SU-2026:23411-1 |
| SLE Micro 5.5 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLE Micro 5.5 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLE Micro 5.4 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLE Micro 5.4 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLE Micro 5.3 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLE Micro 5.3 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLE HPC 15 SP5 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLE HPC 15 SP5 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLE HPC 15 SP5 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLE HPC 15 SP5 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
| SLE HPC 15 SP4 | MozillaFirefox | 140.14.0-150200.152.251.1 | SUSE-SU-2026:4156-1, SUSE-SU-2026:3658-1 |
| SLE HPC 15 SP4 | MozillaFirefox-branding-SLE | 153-150400.14.3.1 | SUSE-SU-2026:4156-1 |
| SLE HPC 15 SP4 | mozilla-nspr | 4.39-150400.12.3.1 | SUSE-SU-2026:4156-1 |
| SLE HPC 15 SP4 | mozilla-nss | 3.125-150400.3.74.1 | SUSE-SU-2026:4156-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 154.0-1.1 | openSUSE-SU-2026:11580-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 140.14.0-1.1 | openSUSE-SU-2026:11558-1 |
| openSUSE Tumbleweed | firefox-esr | 153.1.0-1.1 | openSUSE-SU-2026:11546-1 |
| openSUSE Leap 16.0 | MozillaFirefox | 140.14.0-160000.1.1 | openSUSE-SU-2026:21713-1, openSUSE-SU-2026:21594-1 |
| openSUSE Leap 16.0 | mozilla-nspr | 4.39-160000.1.1 | openSUSE-SU-2026:21713-1 |
| openSUSE Leap 16.0 | mozilla-nss | 3.125-160000.1.1 | openSUSE-SU-2026:21713-1 |
| openSUSE Leap 16.0 | rust-cbindgen | 0.29.4+git0-160000.1.1 | openSUSE-SU-2026:21713-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.14.0-1.amzn2023.0.1 | ALAS2023-2026-2105 |
| Amazon Linux 2 | thunderbird | 140.14.0-1.amzn2.0.1 | ALAS2-2026-3880 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | firefox | 140.14.0-1.0.1.el10_2 | ELSA-2026-58899 |
| Oracle Linux 9 | firefox +1 | 140.14.0-1.0.1.el9_8 | ELSA-2026-58897 |
| Oracle Linux 8 | firefox | 140.14.0-1.0.1.el8_10 | ELSA-2026-58898 |
Advisories 50
- WID-SEC-2026-2911 Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2026:65158 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58897 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58899 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65159 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65160 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58898 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:23590-1 Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:4140-1 Security update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen SUSE / openSUSE Security Updates · Sep 28, 2026
- SUSE-SU-2026:4268-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Sep 19, 2026
- SUSE-SU-2026:4156-1 Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen SUSE / openSUSE Security Updates · Sep 15, 2026
- RHSA-2026:65888 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65765 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65764 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65757 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65442 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65111 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65105 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65110 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:65103 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:64814 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2026:64813 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- SUSE-SU-2026:3897-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:23411-1 Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:23304-1 Security update for MozillaFirefox SUSE / openSUSE Security Updates · Sep 10, 2026
- RHSA-2026:65766 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:65670 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:65633 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:65669 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:65160 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:65158 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:65159 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:58898 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:58899 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RHSA-2026:58897 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Sep 10, 2026
- RLSA-2026:65158 Important: thunderbird security update Rocky Linux Security Advisories · Sep 9, 2026
- RLSA-2026:65159 Important: thunderbird security update Rocky Linux Security Advisories · Sep 9, 2026
- RLSA-2026:65160 Important: thunderbird security update Rocky Linux Security Advisories · Sep 9, 2026
- openSUSE-SU-2026:21713-1 Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen SUSE / openSUSE Security Updates · Sep 2, 2026
- ALAS2-2026-3880 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- ALAS2023-2026-2105 Important: firefox security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- SUSE-SU-2026:3683-1 Security update for MozillaFirefox SUSE / openSUSE Security Updates · Aug 26, 2026
- RLSA-2026:58899 Important: firefox security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:58897 Important: firefox security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:58898 Important: firefox security update Rocky Linux Security Advisories · Aug 26, 2026
- openSUSE-SU-2026:11580-1 MozillaFirefox-154.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 24, 2026
- ELSA-2026-58899 Important: firefox security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
- ELSA-2026-58897 Important: firefox security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
- ELSA-2026-58898 Important: firefox security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
- openSUSE-SU-2026:11546-1 firefox-esr-153.1.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 21, 2026
References
- Moderate Severity internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- High Severity internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Low Severity internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- https://www.mozilla.org/security/advisories/mfsa2026-74/
- https://www.mozilla.org/security/advisories/mfsa2026-76/
- https://www.mozilla.org/security/advisories/mfsa2026-77/
- https://www.mozilla.org/security/advisories/mfsa2026-78/
- https://www.mozilla.org/security/advisories/mfsa2026-79/
- https://www.mozilla.org/security/advisories/mfsa2026-80/