DSA-6394-1 firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, bypass of the same-origin policy, privilege escalation, information disclosure, spoofing or sandbox escape. https://security-tracker.debian.org/tracker/DSA-6394-1
CSIRTS triage
- What
- Multiple security issues in Firefox ESR could lead to arbitrary code execution and other security breaches.
- Who is affected
- Users of Mozilla Firefox ESR.
- Urgency
- Remediation is critical due to the potential for severe exploitation of these vulnerabilities.
- Action
- Apply the latest security update for Firefox ESR.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Firefox ESR
Get an email when a new Firefox ESR advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00305.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-157180.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
- Low exploitation riskCVE-2026-157190.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
- Low exploitation riskCVE-2026-163490.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
- Low exploitation riskCVE-2026-163500.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-163510.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
- Low exploitation riskCVE-2026-163520.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
- Low exploitation riskCVE-2026-163530.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-163540.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-163550.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-163560.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Mozilla Firefox and Firefox ESR: Multiple vulnerabilitiescert-bund
- medium[NEW] [medium] Mozilla Firefox: Multiple vulnerabilities allow unspecified attackcert-bund
- unknownMultiple vulnerabilities in Mozilla Thunderbird (July 23, 2026)cert-fr-avis
- unknownMozilla Products Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in Mozilla products (July 22, 2026)cert-fr-avis
- criticalCVE-2026-16412: Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed ev…nvd
- highCVE-2026-16405: Information disclosure in the Networking: WebSockets component. This vulnerability was fixed i…nvd
- highCVE-2026-16396: Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ES…nvd
- highCVE-2026-16391: Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Fi…nvd
- criticalCVE-2026-16390: Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefo…nvd
- criticalCVE-2026-16387: Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153,…nvd
- criticalCVE-2026-16383: Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 15…nvd
More from Debian Security Advisories
- unknownDSA-6409-1 libgd2 - security update2026-08-01
- unknownDSA-6408-1 chromium - security update2026-07-31
- unknownDSA-6406-1 php8.4 - security update2026-07-31
- unknownDSA-6405-1 linux - security update2026-07-31
- unknownDSA-6407-1 incus - security update2026-07-31