On September 1, 2026, Mozilla released several security updates for Firefox and Thunderbird. A total of 29 security vulnerabilities were closed in the browser and 30 in the mail client – including 13 classified as "high" severity.
Risks and Potential Attack Scenarios
Attackers could exploit these vulnerabilities to:
· Execute malicious code (CVE-2026-84143, among others)
· Break out of the sandbox (CVE-2026-75874)
· Escalate privileges (CVE-2026-16365, CVE-2026-16371)
· Disclose confidential information
Many of these vulnerabilities are use-after-free errors – memory issues that can lead to crashes or arbitrary code execution.
Particularly critical for Thunderbird: malicious content lands directly in the inbox – often unfiltered. While scripting is disabled when reading emails, risks still exist in browser-like contexts. An important note: some Thunderbird vulnerabilities specifically affect Windows users, for example when calendar invitations could launch local programs (CVE-2026-84637).
Affected and Secure Versions
Product Secure Version
Firefox 155
Firefox ESR 140.15, 153.2
Thunderbird 155
Thunderbird ESR 140.15, 153.2
For Debian users, the fixed versions are 140.15.0esr-1~deb13u1 (Firefox) and 1:140.15.0esr-1~deb13u1 (Thunderbird).
How to Perform the Update
Windows / macOS:
Navigate to Help → About Firefox / About Thunderbird. The update will be downloaded automatically and activated after a restart.
Linux:
Perform the update via your distribution's package manager.