Mozilla Firefox and Thunderbird Multiple Vulnerabilities

CERT-Bund has released security advisory WID-SEC-2026-0850 detailing critical vulnerabilities affecting Mozilla Firefox and Mozilla Thunderbird. The advisory highlights a CVSS base score of 8.8, indicating a high severity. Remote, anonymous attackers can exploit these flaws to achieve various malicious outcomes, including arbitrary code execution, denial of service, information disclosure, security mechanism bypass, user deception, and other unspecified impacts. The affected products include specific versions of Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR, impacting users across multiple operating systems such as Android, iOS, Linux, macOS, UNIX, and Windows.

Users and organizations utilizing the affected versions of Mozilla Firefox and Thunderbird are strongly advised to update their software immediately to the patched versions. While the advisory indicates mitigation is available, prompt patching is the most effective defense against these threats. Failure to update could expose systems to significant security risks, including data breaches and system compromise. This advisory applies to both individual consumers and organizations deploying these browsers and email clients.