Changeflow GovPing Data Privacy & Cybersecurity Multiple Mozilla Vulnerabilities Allow Remote C...
Priority review Guidance Added Final

Multiple Mozilla Vulnerabilities Allow Remote Code Execution

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published advisory CERTFR-2026-AVI-0480 on 22 April 2026 disclosing 43 CVEs across Mozilla product lines including Firefox ESR, Firefox, and Thunderbird. Affected versions include Firefox ESR prior to 115.35 and 140.10, Firefox prior to 150, and Thunderbird prior to 140.10 and 150. The vulnerabilities permit remote code execution, privilege escalation, data confidentiality breach, denial of service, and security policy bypass. No compliance deadline is stated; organizations are advised to apply patches from Mozilla's security bulletins mfsa2026-30 through mfsa2026-34.

“De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.”

— CERT-FR , verbatim from source
Why this matters

Organizations running Firefox ESR, Firefox, or Thunderbird should verify their installed versions and apply patches from Mozilla's mfsa2026-30 through mfsa2026-34 bulletins as a priority. IT security teams managing endpoint deployments should consider deploying automated update mechanisms or vulnerability scanning to identify unpatched instances across their infrastructure.

AI-drafted from the source document, validated against GovPing's analyst note standards . For the primary regulatory language, read the source document .
Published by CERT-FR on cert.ssi.gouv.fr . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .

About this source

GovPing monitors CERT-FR Security Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 183 changes logged to date.

View original document View source feed page

What changed

CERT-FR published a security advisory covering 43 vulnerabilities across five Mozilla security bulletins (mfsa2026-30 through mfsa2026-34). The disclosed CVEs (CVE-2026-2781 through CVE-2026-6786) affect Firefox ESR, Firefox, and Thunderbird across multiple version branches. Exploitation risks include arbitrary remote code execution, elevation of privileges, remote denial of service, confidentiality breach, and security policy bypass.

Organizations running affected Mozilla products should verify their installed versions and apply the latest security updates referenced in the vendor bulletins. No specific compliance deadline or regulatory penalty is stated in the advisory. Information technology and security teams should treat this as a priority remediation item given the severity of remote code execution vectors.

Archived snapshot

Apr 22, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 22 avril 2026 N° CERTFR-2026-AVI-0480 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Mozilla

Gestion du document

| Référence | CERTFR-2026-AVI-0480 |
| Titre | Multiples vulnérabilités dans les produits Mozilla |
| Date de la première version | 22 avril 2026 |
| Date de la dernière version | 22 avril 2026 |
| Source(s) | Bulletin de sécurité Mozilla mfsa2026-30 du 21 avril 2026
Bulletin de sécurité Mozilla mfsa2026-31 du 21 avril 2026
Bulletin de sécurité Mozilla mfsa2026-32 du 21 avril 2026
Bulletin de sécurité Mozilla mfsa2026-33 du 21 avril 2026
Bulletin de sécurité Mozilla mfsa2026-34 du 21 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à la confidentialité des données
  • Contournement de la politique de sécurité
  • Déni de service à distance
  • Exécution de code arbitraire à distance
  • Non spécifié par l'éditeur
  • Élévation de privilèges

Systèmes affectés

  • Firefox ESR versions antérieures à 115.35
  • Firefox ESR versions antérieures à 140.10
  • Firefox versions antérieures à 150
  • Thunderbird versions antérieures à 140.10
  • Thunderbird versions antérieures à 150

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 22 avril 2026 Version initiale

Named provisions

Risques Systèmes affectés Résumé Solutions Documentation

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Oracle Solaris and Sun ZFS Storage Allow Remote Code Execution
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Atlassian Products Allow Remote Code Execution
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Apache Airflow Multiple Vulnerabilities Allow Remote Code Execution
Priority review Apr 20, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 22nd, 2026
Instrument
Guidance
Branch
Executive
Source language
fr
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0480

Who this affects

Applies to
Technology companies Government agencies Employers
Industry sector
5112 Software & Technology
Activity scope
Software patching Security vulnerability remediation
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Topics
Data Privacy

Browse Categories

Agriculture & Food Safety 74 AI Regulation 3 Banking & Finance 429 Consumer Protection 94 Courts & Legal 418 Data Privacy & Cybersecurity 92 Defense & National Security 53 Education 60 Energy 101 Environment 160 Gaming 2 Government & Legislation 440 Healthcare 15 Healthcare & Life Sciences 387 Immigration 10 Insurance 80 Labor & Employment 146 Pharma & Drug Safety 21 Professional Licensing 8 Real Estate & Housing 83 Securities & Markets 159 Tax 83 Telecom & Technology 48 Trade & Sanctions 141 Transportation 92

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!