Critical Vulnerability in Firefox ESR Affects Debian Packages
Summary
DEBIAN-CVE-2026-109782: ... Affects firefox-esr versions 102.11.0esr-1 – 153.4.0esr-1~deb13u1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Firefox ESR (Extended Support Release) is a version of the Firefox web browser designed for organizations that manage their client desktops. It provides a stable platform for users who require extended support for their applications. The vulnerability identified as CVE-2026-109782 affects multiple Debian distributions, including Bookworm, Trixie, and Forky, potentially compromising user security and privacy.
Vulnerability Detail
CVE-2026-109782 is a security vulnerability in Firefox ESR that could allow attackers to exploit the browser's functionality, leading to unauthorized access or data leakage. The vulnerability originates from flaws in the browser's handling of certain web content, which can be manipulated by malicious actors. If exploited, this vulnerability may result in severe consequences, including data theft or system compromise.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, users should update their Firefox ESR package to the latest patched version. This can be done by executing the following command in the terminal:
sudo apt update && sudo apt upgrade firefox-esr
Ensure that your system is connected to the internet to download the latest updates.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can disable JavaScript in their Firefox ESR settings to mitigate the risk of exploitation until a patch is applied. This can be done by navigating to 'Preferences' > 'Privacy & Security' > 'Permissions' and unchecking 'Enable JavaScript'. However, this may affect the functionality of many websites.
Conclusion
CVE-2026-109782 poses a significant risk to users of Firefox ESR on Debian systems. It is crucial to update to the patched version of the browser to safeguard against potential exploits. Users should also consider temporary workarounds while awaiting updates.
See every vulnerability recorded for firefox-esr →
FAQ
CVE-2026-109782 is a security vulnerability in the Firefox ESR browser that can be exploited to gain unauthorized access to user data.
The vulnerability affects Debian versions 12 (Bookworm), 13 (Trixie), and 14 (Forky) that use the Firefox ESR package.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update immediately, consider disabling JavaScript as a temporary workaround to reduce the risk of exploitation.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for firefox-esr.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.