Skip to content
Threat Feed
Subscribe
high advisory

Mozilla Firefox and Thunderbird Multiple Vulnerabilities

Multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2026-113399 through CVE-2026-113869, may lead to arbitrary code execution, data confidentiality compromise, or denial of service.

CVE search metadata

CVE search record: CVE-2026-113399. EPSS: 0.18%. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

CVE search record: CVE-2026-113400. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

CVE search record: CVE-2026-113401. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

CVE search record: CVE-2026-113470. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

CVE search record: CVE-2026-113866. Severity: medium. CVSS: 5.9. EPSS: 0.36%. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

CVE search record: CVE-2026-113867. EPSS: 0.18%. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

CVE search record: CVE-2026-113868. Severity: medium. CVSS: 5.3. EPSS: 0.43%. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

CVE search record: CVE-2026-113869. Severity: medium. CVSS: 5.4. EPSS: 0.28%. KEV: no. Product: Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1), Firefox (< 158.0.1), Thunderbird (< 153.5.1), Thunderbird (< 158.0.1). Brief: Mozilla Firefox and Thunderbird Multiple Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mozilla-vulnerabilities/

Triage facts

Revision 1
Applicability
Firefox ESR (< 115.43.1), Firefox ESR (< 153.5.1) +3
Evidence
Unknown
Severity
High
Action
Elevated
Sources
6 public sources
Freshness
Revision 1Oct 21, 16:07 UTC
Vulnerabilities
8 CVEs
Source quality
A1Likely

The French National Cybersecurity Agency (ANSSI) has published an advisory regarding multiple vulnerabilities affecting various versions of Mozilla Firefox and Thunderbird. These flaws allow for arbitrary code execution, compromise of sensitive data, and denial of service. The vulnerabilities are detailed in Mozilla security advisories MFSA 2026-111 through MFSA 2026-115.

Impact

Successful exploitation may result in unauthorized arbitrary code execution, loss of data confidentiality, or application-level denial of service.

Recommendation

  • Inventory all enterprise installations of Mozilla Firefox and Thunderbird to identify versions within the affected ranges.
  • Upgrade Mozilla Firefox to version 158.0.1 or later.
  • Upgrade Mozilla Firefox ESR to version 115.43.1 or 153.5.1 or later as appropriate for the specific release track.
  • Upgrade Mozilla Thunderbird to version 153.5.1 or 158.0.1 or later.
  • Review the specific Mozilla security advisories (MFSA 2026-111 to MFSA 2026-115) for additional technical context.

Mitigations

Upgrade Firefox and Thunderbird to the latest versions defined in the source (e.g., 158.0.1, 153.5.1, or 115.43.1)

immediate IT Operations

CVE-2026-113399, CVE-2026-113400, CVE-2026-113401, CVE-2026-113470, CVE-2026-113866, CVE-2026-113867, CVE-2026-113868, CVE-2026-113869