Multiple vulnerabilities in Mozilla Firefox ESR

Description

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. Security vulnerability in the Remote Settings Client component can be exploited to bypass security restrictions.
2. A remote code execution vulnerability in the JavaScript: GC component can be exploited remotely to execute arbitrary code.
3. A remote code execution vulnerability in the DOM: Navigation component can be exploited remotely to execute arbitrary code.
4. A remote code execution vulnerability in the Audio/Video component can be exploited remotely to execute arbitrary code.
5. A remote code execution vulnerability in the DOM: Security component can be exploited remotely to execute arbitrary code.
6. A remote code execution vulnerability in the Graphics: WebGPU component can be exploited remotely to execute arbitrary code.
7. A remote code execution vulnerability in the DOM: Core & HTML component can be exploited remotely to execute arbitrary code.
8. Security vulnerability in the Application Update component can be exploited to bypass security restrictions.
9. Security vulnerability can be exploited to bypass security restrictions.
10. Information disclosure vulnerability in the Graphics: WebGPU component can be exploited to obtain sensitive information.
11. Denial of service vulnerability in the Graphics component can be exploited remotely to cause denial of service.
12. Information disclosure vulnerability in the Networking: HTTP component can be exploited to obtain sensitive information.
13. Denial of service vulnerability in the Profile Backup component can be exploited remotely to cause denial of service.
14. Denial of service vulnerability in the DOM: Navigation component can be exploited remotely to cause denial of service.
15. Security UI vulnerability in the DOM: Core & HTML component can be exploited to spoof user interface.
16. A remote code execution vulnerability in the Graphics: ImageLib component can be exploited remotely to execute arbitrary code.

Original advisories

• MFSA2026-85

Exploitation

Related products

• Mozilla-Firefox-ESR

CVE list

• CVE-2026-74952
  critical
• CVE-2026-75874
  critical
• CVE-2026-84118
  high
• CVE-2026-84119
  critical
• CVE-2026-84120
  high
• CVE-2026-84121
  critical
• CVE-2026-84122
  high
• CVE-2026-84123
  critical
• CVE-2026-84124
  high
• CVE-2026-84125
  high
• CVE-2026-84129
  unknown
• CVE-2026-84130
  unknown
• CVE-2026-84131
  critical
• CVE-2026-84132
  unknown
• CVE-2026-84133
  unknown
• CVE-2026-84134
  unknown
• CVE-2026-84136
  unknown
• CVE-2026-84137
  unknown
• CVE-2026-84139
  unknown
• CVE-2026-84140
  unknown
• CVE-2026-84141
  unknown
• CVE-2026-84143
  unknown
• CVE-2026-84144
  unknown
• CVE-2026-84145
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com