1.0 Introduction
Recently, Mozilla has released security updates to address multiple vulnerabilities in Firefox, Firefox ESR, Firefox for iOS and Thunderbird.
2.0 Impact
Successful exploitation of these vulnerabilities may allow a remote attacker to trigger denial of service, elevation of privilege, security restriction bypass, sensitive information disclosure, data manipulation and spoofing on the targeted system. The issues fixed include use-after-free flaws in the IndexedDB and graphics components, an integer overflow in graphics, privilege escalation in the WebExtensions and Application Update components, mitigation bypass in File Handling and Enterprise Policies, and information disclosure in the PDF Viewer and WebRTC components. This may lead to unauthorised access to sensitive information and system compromise when a user visits a specially crafted web page or opens a malicious message.
3.0 Affected Products
- Mozilla Firefox, versions earlier than 158
- Mozilla Firefox ESR 153, versions earlier than 153.5
- Mozilla Firefox ESR 115, versions earlier than 115.43
- Mozilla Firefox for iOS, versions earlier than 157.1
- Mozilla Thunderbird, versions earlier than 158
- Mozilla Thunderbird 153, versions earlier than 153.5
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review the following Mozilla security advisories and apply the necessary updates. Users are advised to update to Firefox 158, Firefox ESR 153.5 or 115.43, Firefox for iOS 157.1, and Thunderbird 158 or 153.5, or later versions.
Kindly refer to the following URL:
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-107/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-110/
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://www.mozilla.org/en-US/security/advisories/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-107/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-110/