Security Vulnerabilities in Firefox and Thunderbird: Updates Available

On September 1, 2026, Mozilla released several security updates for Firefox and Thunderbird. A total of 29 security vulnerabilities were closed in the browser and 30 in the mail client – including 13 classified as "high" severity.

Risks and Potential Attack Scenarios

Attackers could exploit these vulnerabilities to:

· Execute malicious code (CVE-2026-84143, among others)

· Break out of the sandbox (CVE-2026-75874)

· Escalate privileges (CVE-2026-16365, CVE-2026-16371)

· Disclose confidential information

Many of these vulnerabilities are use-after-free errors – memory issues that can lead to crashes or arbitrary code execution.

Particularly critical for Thunderbird: malicious content lands directly in the inbox – often unfiltered. While scripting is disabled when reading emails, risks still exist in browser-like contexts. An important note: some Thunderbird vulnerabilities specifically affect Windows users, for example when calendar invitations could launch local programs (CVE-2026-84637).

Affected and Secure Versions

Product Secure Version

Firefox 155

Firefox ESR 140.15, 153.2

Thunderbird 155

Thunderbird ESR 140.15, 153.2

For Debian users, the fixed versions are 140.15.0esr-1~deb13u1 (Firefox) and 1:140.15.0esr-1~deb13u1 (Thunderbird).

How to Perform the Update

Windows / macOS:

Navigate to Help → About Firefox / About Thunderbird. The update will be downloaded automatically and activated after a restart.

Linux:

Perform the update via your distribution's package manager.