CERT-In has issued a high-severity warning about security flaws in Mozilla Firefox and Thunderbird, asking users to install the relevant vendor updates. The Indian agency's 5 October advisory covers several release branches, so the version to check depends on the browser or mail application actually installed.

There is a further detail for ordinary Firefox users: Mozilla published another security fix in Firefox 157.0.1 on 6 October, after the Indian warning. Firefox 157 is therefore the threshold cited for the earlier group of flaws, not the last security update users need to consider.

Match the version to the release branch

CERT-In advisory CIVN-2026-0488 lists Firefox versions before 157. For Firefox Extended Support Release, or ESR, it lists versions before 115.42, 140.17 and 153.4 within their respective branches. Its Thunderbird entries cover versions before 140.17, 153.4 and 157, again according to the release branch.

These are separate version lines, not a single sequence that every user must move through. An installation on the ESR 140 branch, for example, should be checked against the 140.17 threshold in this notice. The presence of a 153-series entry does not mean the advisory requires every ESR 140 installation to switch branches.

Mozilla's corresponding Firefox 157 security notice is dated 29 September. Separate notices from the same date identify ESR 115.42, ESR 140.17 and ESR 153.4 as fixed releases. Thunderbird's matching notices, dated 30 September, identify 140.17, 153.4 and 157 as the fixed versions for that application.

The later Firefox 157.0.1 notice addresses CVE-2026-106016, a mitigation-bypass issue in file handling. Mozilla rates that particular follow-up issue moderate. This rating belongs to the later flaw; it does not replace CERT-In's high-severity classification for the broader advisory.

What the warnings establish

CERT-In says the vulnerabilities could enable outcomes including denial of service, privilege escalation, information disclosure, security bypass, sandbox escape and spoofing. Its notice addresses organisations and individual users. It does not report an Indian breach, give a victim count or say that the listed flaws have been exploited in the wild.

The Firefox 157 notice includes sandbox-escape flaws in DOM Navigation and Security Process Sandboxing, identified as CVE-2026-100758 and CVE-2026-100760. It also lists JIT miscompilation issues. These component-level descriptions explain why the update contains more than one fix. Mozilla also says internally discovered memory-safety vulnerabilities now receive individual CVE identifiers instead of being grouped together. A longer identifier list should therefore not be interpreted as a count of incidents or affected users.

There is an important qualification for the mail client. Mozilla's Thunderbird 157 advisory says the flaws generally cannot be exploited through email because scripting is disabled while reading mail. It nevertheless warns about browser or browser-like contexts. The notice should not be turned into a claim that simply receiving an ordinary email takes over Thunderbird.

Apply the update through the installed application

For Mozilla-installed Firefox, the official update instructions direct users to the menu, Help or Help and Report, then About Firefox. On a Mac, About Firefox is under the Firefox menu. That window checks for updates and downloads them when available; a restart applies the installation.

Mozilla notes that the About window can display an up-to-date message while a background download is still finishing. The update takes effect after the restart. Linux installations managed by a distribution use the system's package updates, while a Firefox installation from Microsoft Store updates through the Store. The route therefore depends on how the browser was installed.

Thunderbird has its own update procedure: Help, About Thunderbird, then the restart-to-update control after the download. Distribution-managed Linux installations use their package update route. Updating Firefox does not update a separately installed mail client; users running both need to check both applications.

Dalimss News previously covered a separate September desktop Chrome advisory. Its version numbers do not apply to Mozilla software. The October Android security-patch warning likewise concerns a different update check. Here, the actionable information is the Mozilla application, its release branch and the full version shown after the relevant update has been applied.