Windows apps · Mozilla
Mozilla Firefox ESR (ta) security updates
The latest version of Mozilla Firefox ESR (ta) is 153.7.0, released November 10, 2026. Patch Radar has 15 security fixes for Mozilla Firefox ESR (ta), closing 903 CVEs, 3 of which are being exploited. The newest security fix is Mozilla Firefox ESR (ta) 153.4.0, released September 29, 2026. Version 153.7.0 adds no new CVE fixes and includes all of them. 47 CVEs have no fix yet.
3 exploited CVEs47 with no fix yet
Latest version
153.7.0
Released Nov 10, 2026
Security fixes
15
On record in Patch Radar
CVEs
903
Closed by those fixes
Exploited
3
Vendor report or CISA KEV
CVEs with no fix yet
| Priority | CVE | Title | Status |
|---|---|---|---|
| Urgent | CVE-2026-100763 | Incorrect boundary conditions in the Graphics: WebGPU component | no-fix |
| Urgent | CVE-2026-100804 | Sandbox escape due to use-after-free in the Preferences: Backend component | no-fix |
| Urgent | CVE-2026-100810 | Other issue in the DevTools component | no-fix |
| Urgent | CVE-2026-106016 | Mitigation bypass in the File Handling component | no-fix |
| Urgent | CVE-2026-74956 | Same-origin policy bypass in the DOM: Service Workers component | no-fix |
| Urgent | CVE-2026-74979 | Mitigation bypass in the Add-ons Manager component | no-fix |
| Urgent | CVE-2026-74989 | Internally found bugs fixed in Thunderbird 154 | no-fix |
| Urgent | CVE-2026-84142 | Internally found bugs fixed in Thunderbird 155 | no-fix |
| Urgent | CVE-2026-92034 | Site isolation issue in the Graphics component | no-fix |
| Urgent | CVE-2026-92036 | Incorrect boundary conditions in the Networking: HTTP component | no-fix |
| Urgent | CVE-2026-92037 | Incorrect boundary conditions in the DOM: Animation component | no-fix |
| Urgent | CVE-2026-92050 | Sandbox escape due to race condition in the XPConnect component | no-fix |
| Urgent | CVE-2026-92051 | Spoofing issue due to invalid pointer in the Graphics component | no-fix |
| Urgent | CVE-2026-92061 | Incorrect boundary conditions in the Security: Process Sandboxing component | no-fix |
| Urgent | CVE-2026-92066 | Sandbox escape in the Profile Backup component | no-fix |
| High | CVE-2026-100761 | Privilege escalation due to use-after-free in the Graphics: WebGPU component | no-fix |
| High | CVE-2026-100764 | Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component | no-fix |
| High | CVE-2026-100768 | Use-after-free in the Graphics: WebGPU component | no-fix |
| High | CVE-2026-100779 | Use-after-free in the XSLT component | no-fix |
| High | CVE-2026-100780 | Use-after-free in the DOM: Core & HTML component | no-fix |
| High | CVE-2026-100781 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | no-fix |
| High | CVE-2026-100796 | Use-after-free in the JavaScript: WebAssembly component | no-fix |
| High | CVE-2026-100805 | Race condition, use-after-free in the Audio/Video component | no-fix |
| High | CVE-2026-100813 | Invalid pointer in the JavaScript Engine: JIT component | no-fix |
| High | CVE-2026-74937 | Use-after-free in the JavaScript: GC component | no-fix |
| High | CVE-2026-74938 | Mitigation bypass in the JavaScript: GC component | no-fix |
| High | CVE-2026-74940 | Use-after-free in the Graphics: Text component | no-fix |
| High | CVE-2026-74947 | Privilege escalation due to invalid pointer in the Graphics component | no-fix |
| High | CVE-2026-74950 | Privilege escalation in the Downloads API component | no-fix |
| High | CVE-2026-74952 | Privilege escalation in the Application Update component | no-fix |
| High | CVE-2026-74954 | Information disclosure due to side-channel in the Storage: Cache API component | no-fix |
| High | CVE-2026-74955 | Privilege escalation in the Request Handling component | no-fix |
| High | CVE-2026-74958 | Information disclosure in the WebRTC component | no-fix |
| High | CVE-2026-74963 | Same-origin policy bypass in the Networking: Cookies component | no-fix |
| High | CVE-2026-74965 | Privilege escalation in the Shell Integration component | no-fix |
| High | CVE-2026-75874 | Sandbox escape in the Remote Settings Client component | no-fix |
| High | CVE-2026-84128 | Privilege escalation in the WebDriver BiDi component | no-fix |
| High | CVE-2026-92040 | Use-after-free in the JavaScript: WebAssembly component | no-fix |
| Routine | CVE-2026-100793 | JIT miscompilation in the JavaScript Engine component | no-fix |
| Routine | CVE-2026-100795 | Denial-of-service in the Networking component | no-fix |
| Routine | CVE-2026-100799 | Uninitialized memory in the Graphics: WebGPU component | no-fix |
| Routine | CVE-2026-100802 | Uninitialized memory in the Graphics: WebGPU component | no-fix |
| Routine | CVE-2026-100817 | Other issue in the JavaScript: WebAssembly component | no-fix |
| Routine | CVE-2026-74968 | Site isolation issue in the Graphics: WebRender component | no-fix |
| Routine | CVE-2026-84126 | Incorrect boundary conditions in the Layout: Grid component | no-fix |
| Routine | CVE-2026-84138 | Denial-of-service in the PDF Viewer component | no-fix |
| Routine | CVE-2026-92063 | Denial-of-service in the Audio/Video component | no-fix |
Security fixes, newest first
| Priority | Fix | Fixed in | CVEs | Exploited | Released |
|---|---|---|---|---|---|
| Latest | Mozilla Firefox ESR (ta) 153.7.0 | 153.7.0 | Includes every fix below | Nov 10, 2026 | |
| Urgent | Mozilla Firefox ESR (ta) 153.4.0 | 153.4.0 | 59 | Sep 29, 2026 | |
| Urgent | Mozilla Firefox ESR (ta) 153.3.0 | 153.3.0 | 63 | Sep 15, 2026 | |
| Urgent | Mozilla Firefox ESR (ta) 153.2.0 | 153.2.0 | 22 | Sep 1, 2026 | |
| Urgent | Mozilla Firefox ESR (ta) 153.1.0 | 153.1.0 | 39 | Aug 18, 2026 | |
| Urgent | Mozilla Firefox ESR (ta) 140.13.0 | 140.13.0 | 1 | Jul 21, 2026 | |
| Urgent | Mozilla Firefox ESR (ta) 153.0.0 | 153.0.0 | 389 | Jul 20, 2026 | |
| High | Mozilla Firefox ESR (ta) 140.12.0 | 140.12.0 | 2 | Jun 16, 2026 | |
| High | Mozilla Firefox ESR (ta) 140.10.2 | 140.10.2 | 2 | May 7, 2026 | |
| High | Mozilla Firefox ESR (ta) 140.10.1 | 140.10.1 | 1 | Apr 28, 2026 | |
| High | Mozilla Firefox ESR (ta) 140.10.0 | 140.10.0 | 1 | Apr 21, 2026 | |
| Patch now | Mozilla Firefox ESR (ta) 140.3.0 | 140.3.0 | 142 | 1 | Sep 16, 2025 |
| High | Mozilla Firefox ESR (ta) 128.11.0 | 128.11.0 | 1 | May 27, 2025 | |
| High | Mozilla Firefox ESR (ta) 128.10.0 | 128.10.0 | 2 | Apr 29, 2025 | |
| Patch now | Mozilla Firefox ESR (ta) 128.3.0 | 128.3.0 | 178 | 2 | Oct 1, 2024 |
| High | Mozilla Firefox ESR (ta) 115.9.0 | 115.9.0 | 1 | Mar 19, 2024 | |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.