Multiple critical vulnerabilities in Mozilla Firefox, Thunderbird allow arbitrary code execution and data confidentiality breaches
Multiple security vulnerabilities have been identified in Mozilla products including Firefox ESR prior to version 153.7, Firefox prior to version 160, and Thunderbird prior to version 160. These vulnerabilities allow attackers to perform arbitrary code execution, privilege escalation, and compromise data confidentiality. The issues were disclosed on November 10, 2026, across multiple Mozilla security advisories (MFSA 2026-125 to 129). Users should refer to official Mozilla security bulletins and update to the latest versions to mitigate these risks. The vulnerabilities include a wide range of critical issues documented under several CVEs, notably CVE-2026-109736 and CVE-2026-118007 among others.
Entenda a falha
A vulnerabilidade
Mozilla published a large batch of CVEs affecting Firefox ESR before 153.7, Firefox before 160 and Thunderbird before 160. According to CERT-FR, some of them allow arbitrary code execution, privilege escalation and breaches of data confidentiality. CERT-FR also lists security policy bypass among the impacts. The articles do not detail individual CVEs, so the attacker prerequisites (user interaction, configuration, network reach) are not stated. The fixes are Firefox ESR 153.7 and Firefox and Thunderbird 160, per the advisories MFSA 2026-125 to 129.
Como foi descoberta
Mozilla disclosed the issues on 10 November 2026 in security advisories MFSA 2026-125, 126, 127, 128 and 129. CERT-FR republished them in notice CERTFR-2026-AVI-1505 on 12 November 2026 and points to Mozilla's bulletins for the patches. The articles do not say who found the flaws or how.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:22.
Linha do tempo
-
Multiple critical vulnerabilities in Mozilla Firefox, Thunderbird allow arbitrary code execution and data confidentiality breaches
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been identified in Mozilla products including Firefox ESR prior to version 153.7, Firefox prior to version 160, and Thunderbird prior to version 160. These vulnerabilities allow attackers to perform arbitrary code execution, privilege escalation, and compromise data confidentiality. The issues were disclosed on November 10, 2026, across multiple Mozilla security advisories (MFSA 2026-125 to 129). Users should refer to official Mozilla security bulletins and update to the latest versions to mitigate these risks. The vulnerabilities include a wide range of critical issues documented under several CVEs, notably CVE-2026-109736 and CVE-2026-118007 among others.