Zero Radar
← feed
HighVulnerabilityupdated 29 Oct 2026, 12:58 UTC

Firefox and Thunderbird: several security flaws, attackers may run code

Several bugs in the Firefox and Thunderbird programs could let an attacker take control of parts of your browser or mail program, read or change data, or crash the program. Keeping them updated closes these gaps.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdate to the current upstream releases; Debian provides the fix via DSA-6585-1 with Thunderbird 153.x. Exact fixed version numbers are not stated in the material. · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

Multiple memory-safety and logic vulnerabilities in Mozilla Firefox, Firefox ESR and Thunderbird allow privilege escalation, security-control bypass, information disclosure, data manipulation, spoofing, denial of service and, in some reports, arbitrary code execution.

Why it is dangerous: Successful exploitation could let an attacker run malicious code, steal or alter sensitive information, or spoof content, especially when a user visits a malicious site or opens a crafted message.

Are you affected?

You are affected if you run Mozilla Firefox, Firefox ESR or Thunderbird in a version older than the fixed releases listed by the vendor and Debian (Debian DSA-6585-1 moves Thunderbird to the 153.x series, as 140.x is no longer supported).

Mozilla Firefox, Firefox ESR and Mozilla Thunderbird (versions not specified in the material); Debian Thunderbird 140.x series (no longer supported).

What to do

  1. Update Firefox, Firefox ESR and Thunderbird to the latest version right away
  2. On Debian systems, install the Thunderbird update from DSA-6585-1 (153.x series)
  3. Restart the browser and mail program after updating
  4. Check that automatic updates are enabled

Timeline

  1. 23 Oct 2026, 10:22 UTC
    Publicly disclosed
  2. 23 Oct 2026, 10:22 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 23 Oct 2026, 10:22 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  4. 23 Oct 2026, 10:22 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  5. 23 Oct 2026, 11:25 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  6. 25 Oct 2026, 15:20 UTC
    Picked up by Zero Radar
  7. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  8. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  9. 26 Oct 2026, 12:30 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  10. 26 Oct 2026, 12:34 UTC
    Fix: Updated versions released by Mozilla; specific version numbers not stated in the provided material
  11. 27 Oct 2026, 18:20 UTC
    Debian Security reported on it · Debian Security
  12. 29 Oct 2026, 12:57 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)

Sources 9 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-70bfb3d8 · ZR-03514dde · ZR-945c211b · ZR-1567371c · ZR-6610365f · ZR-0e8b9b96
Disclosed
23 Oct 2026, 10:22 UTC
On Zero Radar
25 Oct 2026, 15:20 UTC (2 days after disclosure)
Last change
29 Oct 2026, 12:58 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Firefox and Thunderbird: several security flaws, attackers may run code · Zero Radar