# Mozilla Firefox ESR (ca) 153.7.0 Mozilla Firefox ESR (ca) 153.7.0, released November 10, 2026, fixes 47 CVEs in Mozilla Firefox ESR (ca). None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr.ca-153.7.0 - Platform: Windows apps - Released: Nov 10, 2026 - Priority: Urgent (Closes CVE-2026-74989, rated Critical) - CVEs: 47, exploited: 0, on CISA KEV: 0 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Mozilla Firefox ESR (ca)](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-ca.md) | | 153.7.0 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-74989](https://patchblox.com/security/data/cve/CVE-2026-74989.md) | Urgent | Internally found bugs fixed in Thunderbird 154 | 9.8 | 0.0057 | | | [CVE-2026-84142](https://patchblox.com/security/data/cve/CVE-2026-84142.md) | Urgent | Internally found bugs fixed in Thunderbird 155 | 9.8 | 0.0056 | | | [CVE-2026-92036](https://patchblox.com/security/data/cve/CVE-2026-92036.md) | Urgent | Incorrect boundary conditions in the Networking: HTTP component | 9.8 | 0.0055 | | | [CVE-2026-92037](https://patchblox.com/security/data/cve/CVE-2026-92037.md) | Urgent | Incorrect boundary conditions in the DOM: Animation component | 9.8 | 0.0055 | | | [CVE-2026-92061](https://patchblox.com/security/data/cve/CVE-2026-92061.md) | Urgent | Incorrect boundary conditions in the Security: Process Sandboxing component | 9.8 | 0.0055 | | | [CVE-2026-92066](https://patchblox.com/security/data/cve/CVE-2026-92066.md) | Urgent | Sandbox escape in the Profile Backup component | 9.8 | 0.0055 | | | [CVE-2026-92051](https://patchblox.com/security/data/cve/CVE-2026-92051.md) | Urgent | Spoofing issue due to invalid pointer in the Graphics component | 9.1 | 0.0053 | | | [CVE-2026-74956](https://patchblox.com/security/data/cve/CVE-2026-74956.md) | Urgent | Same-origin policy bypass in the DOM: Service Workers component | 9.1 | 0.0050 | | | [CVE-2026-92050](https://patchblox.com/security/data/cve/CVE-2026-92050.md) | Urgent | Sandbox escape due to race condition in the XPConnect component | 9.1 | 0.0041 | | | [CVE-2026-100810](https://patchblox.com/security/data/cve/CVE-2026-100810.md) | Urgent | Other issue in the DevTools component | 9.8 | 0.0038 | | | [CVE-2026-100763](https://patchblox.com/security/data/cve/CVE-2026-100763.md) | Urgent | Incorrect boundary conditions in the Graphics: WebGPU component | 9.1 | 0.0038 | | | [CVE-2026-106016](https://patchblox.com/security/data/cve/CVE-2026-106016.md) | Urgent | Mitigation bypass in the File Handling component | 9.8 | 0.0032 | | | [CVE-2026-74979](https://patchblox.com/security/data/cve/CVE-2026-74979.md) | Urgent | Mitigation bypass in the Add-ons Manager component | 9.8 | 0.0031 | | | [CVE-2026-100804](https://patchblox.com/security/data/cve/CVE-2026-100804.md) | Urgent | Sandbox escape due to use-after-free in the Preferences: Backend component | 9.6 | 0.0028 | | | [CVE-2026-92034](https://patchblox.com/security/data/cve/CVE-2026-92034.md) | Urgent | Site isolation issue in the Graphics component | 9.1 | 0.0027 | | | [CVE-2026-75874](https://patchblox.com/security/data/cve/CVE-2026-75874.md) | High | Sandbox escape in the Remote Settings Client component | 10.0 | 0.0046 | | | [CVE-2026-74958](https://patchblox.com/security/data/cve/CVE-2026-74958.md) | High | Information disclosure in the WebRTC component | 7.5 | 0.0045 | | | [CVE-2026-74947](https://patchblox.com/security/data/cve/CVE-2026-74947.md) | High | Privilege escalation due to invalid pointer in the Graphics component | 8.8 | 0.0045 | | | [CVE-2026-74938](https://patchblox.com/security/data/cve/CVE-2026-74938.md) | High | Mitigation bypass in the JavaScript: GC component | 9.1 | 0.0044 | | | [CVE-2026-74954](https://patchblox.com/security/data/cve/CVE-2026-74954.md) | High | Information disclosure due to side-channel in the Storage: Cache API component | 7.5 | 0.0044 | | | [CVE-2026-84128](https://patchblox.com/security/data/cve/CVE-2026-84128.md) | High | Privilege escalation in the WebDriver BiDi component | 8.8 | 0.0044 | | | [CVE-2026-74937](https://patchblox.com/security/data/cve/CVE-2026-74937.md) | High | Use-after-free in the JavaScript: GC component | 8.8 | 0.0044 | | | [CVE-2026-92040](https://patchblox.com/security/data/cve/CVE-2026-92040.md) | High | Use-after-free in the JavaScript: WebAssembly component | 8.8 | 0.0042 | | | [CVE-2026-74950](https://patchblox.com/security/data/cve/CVE-2026-74950.md) | High | Privilege escalation in the Downloads API component | 8.8 | 0.0042 | | | [CVE-2026-74952](https://patchblox.com/security/data/cve/CVE-2026-74952.md) | High | Privilege escalation in the Application Update component | 8.8 | 0.0042 | | | [CVE-2026-74955](https://patchblox.com/security/data/cve/CVE-2026-74955.md) | High | Privilege escalation in the Request Handling component | 8.8 | 0.0042 | | | [CVE-2026-74940](https://patchblox.com/security/data/cve/CVE-2026-74940.md) | High | Use-after-free in the Graphics: Text component | 9.8 | 0.0041 | | | [CVE-2026-100781](https://patchblox.com/security/data/cve/CVE-2026-100781.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | 9.6 | 0.0033 | | | [CVE-2026-100779](https://patchblox.com/security/data/cve/CVE-2026-100779.md) | High | Use-after-free in the XSLT component | 8.8 | 0.0033 | | | [CVE-2026-100780](https://patchblox.com/security/data/cve/CVE-2026-100780.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0032 | | | [CVE-2026-74965](https://patchblox.com/security/data/cve/CVE-2026-74965.md) | High | Privilege escalation in the Shell Integration component | 8.8 | 0.0030 | | | [CVE-2026-100768](https://patchblox.com/security/data/cve/CVE-2026-100768.md) | High | Use-after-free in the Graphics: WebGPU component | 8.8 | 0.0029 | | | [CVE-2026-100796](https://patchblox.com/security/data/cve/CVE-2026-100796.md) | High | Use-after-free in the JavaScript: WebAssembly component | 8.8 | 0.0028 | | | [CVE-2026-100764](https://patchblox.com/security/data/cve/CVE-2026-100764.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component | 8.8 | 0.0023 | | | [CVE-2026-100813](https://patchblox.com/security/data/cve/CVE-2026-100813.md) | High | Invalid pointer in the JavaScript Engine: JIT component | 8.8 | 0.0023 | | | [CVE-2026-100761](https://patchblox.com/security/data/cve/CVE-2026-100761.md) | High | Privilege escalation due to use-after-free in the Graphics: WebGPU component | 8.8 | 0.0023 | | | [CVE-2026-100805](https://patchblox.com/security/data/cve/CVE-2026-100805.md) | High | Race condition, use-after-free in the Audio/Video component | 7.5 | 0.0021 | | | [CVE-2026-74963](https://patchblox.com/security/data/cve/CVE-2026-74963.md) | High | Same-origin policy bypass in the Networking: Cookies component | 7.5 | 0.0012 | | | [CVE-2026-92063](https://patchblox.com/security/data/cve/CVE-2026-92063.md) | Routine | Denial-of-service in the Audio/Video component | 6.5 | 0.0038 | | | [CVE-2026-84138](https://patchblox.com/security/data/cve/CVE-2026-84138.md) | Routine | Denial-of-service in the PDF Viewer component | 6.5 | 0.0037 | | | [CVE-2026-84126](https://patchblox.com/security/data/cve/CVE-2026-84126.md) | Routine | Incorrect boundary conditions in the Layout: Grid component | 4.3 | 0.0031 | | | [CVE-2026-100793](https://patchblox.com/security/data/cve/CVE-2026-100793.md) | Routine | JIT miscompilation in the JavaScript Engine component | 6.5 | 0.0027 | | | [CVE-2026-100795](https://patchblox.com/security/data/cve/CVE-2026-100795.md) | Routine | Denial-of-service in the Networking component | 6.5 | 0.0026 | | | [CVE-2026-100799](https://patchblox.com/security/data/cve/CVE-2026-100799.md) | Routine | Uninitialized memory in the Graphics: WebGPU component | 4.3 | 0.0024 | | | [CVE-2026-100802](https://patchblox.com/security/data/cve/CVE-2026-100802.md) | Routine | Uninitialized memory in the Graphics: WebGPU component | 4.3 | 0.0024 | | | [CVE-2026-100817](https://patchblox.com/security/data/cve/CVE-2026-100817.md) | Routine | Other issue in the JavaScript: WebAssembly component | 5.4 | 0.0020 | | | [CVE-2026-74968](https://patchblox.com/security/data/cve/CVE-2026-74968.md) | Routine | Site isolation issue in the Graphics: WebRender component | 5.4 | 0.0016 | | --- Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.