CERT-FR advisory CERTFR-2026-AVI-1406: multiple Mozilla Firefox, Firefox ESR and Thunderbird vulnerabilities allow remote code execution
CERT-FR published advisory CERTFR-2026-AVI-1406 on 28 October 2026, relaying Mozilla security bulletins mfsa2026-118 to mfsa2026-122 of 27 October 2026. The advisory covers multiple vulnerabilities in Firefox, Firefox ESR and Thunderbird. According to CERT-FR, some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. The advisory also lists data confidentiality breach and security policy bypass as possible impacts. It does not mention in-the-wild exploitation or provide per-CVE details.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1406 relays Mozilla bulletins mfsa2026-118 to mfsa2026-122 and lists about 190 CVEs (CVE-2026-100801 to CVE-2026-118180) in Firefox, Firefox ESR and Thunderbird. The advisory does not map CVEs to individual flaws or give severities. It says some of them allow remote arbitrary code execution, privilege escalation and remote denial of service. It also lists confidentiality breach, security policy bypass and impacts the vendor left unspecified. Affected: Firefox before 159, Firefox ESR before 115.44 and before 153.6, Thunderbird before 153.6 and before 159. Fixed in Firefox 159, ESR 115.44 or 153.6, and Thunderbird 153.6 or 159, depending on the branch. The advisory does not state what an attacker needs, such as user interaction.
Como funciona
The advisory does not describe how any of the individual flaws work, so no per-flaw sequence can be given. It only states the overall impact categories: remote code execution, privilege escalation, remote denial of service, confidentiality breach and security policy bypass. The details are in the Mozilla bulletins mfsa2026-118 to mfsa2026-122, which were not included in the material available.
Por que é vulnerável
The articles do not state the root causes of these flaws, nor why they went unnoticed. The CERT-FR advisory gives no per-CVE analysis and classifies some impacts as unspecified by the vendor. The fix is to update to the patched releases listed in the Mozilla bulletins.
Como foi descoberta
CERT-FR says multiple vulnerabilities were discovered in Mozilla products, without naming who found them or how. It published its advisory on 28 October 2026, relaying Mozilla security bulletins mfsa2026-118 to mfsa2026-122 dated 27 October 2026. The advisory does not mention exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 14:19.
Detalhes técnicos
- Affected: Firefox versions prior to 159; Firefox ESR versions prior to 115.44 and prior to 153.6; Thunderbird versions prior to 153.6 and prior to 159.
- Impact categories: remote arbitrary code execution, privilege escalation, remote denial of service, confidentiality breach, security policy bypass, and "unspecified by the vendor".
- The advisory references a large set of CVEs (about 190, from CVE-2026-100801 to CVE-2026-118180) without mapping them to individual flaws or severity.
Remediação
- Apply the fixes described in the Mozilla security bulletins mfsa2026-118 through mfsa2026-122, i.e. update to Firefox 159 or later, Firefox ESR 115.44 or 153.6 or later, and Thunderbird 153.6 or 159 or later, according to the branch in use.
Linha do tempo
-
CERT-FR advisory CERTFR-2026-AVI-1406: multiple Mozilla Firefox, Firefox ESR and Thunderbird vulnerabilities allow remote code execution
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1406 on 28 October 2026, relaying Mozilla security bulletins mfsa2026-118 to mfsa2026-122 of 27 October 2026. The advisory covers multiple vulnerabilities in Firefox, Firefox ESR and Thunderbird. According to CERT-FR, some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. The advisory also lists data confidentiality breach and security policy bypass as possible impacts. It does not mention in-the-wild exploitation or provide per-CVE details.
Technical Details
- Affected: Firefox versions prior to 159; Firefox ESR versions prior to 115.44 and prior to 153.6; Thunderbird versions prior to 153.6 and prior to 159.
- Impact categories: remote arbitrary code execution, privilege escalation, remote denial of service, confidentiality breach, security policy bypass, and "unspecified by the vendor".
- The advisory references a large set of CVEs (about 190, from CVE-2026-100801 to CVE-2026-118180) without mapping them to individual flaws or severity.
Remediation
- Apply the fixes described in the Mozilla security bulletins mfsa2026-118 through mfsa2026-122, i.e. update to Firefox 159 or later, Firefox ESR 115.44 or 153.6 or later, and Thunderbird 153.6 or 159 or later, according to the branch in use.