First published 12 November 2026 (Pre-Notification)
CVSS:3.1: 8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Security vulnerabilities have been found in Firefox ESR, a web browser used in IGEL OS. This affects the following product versions:
-
IGEL OS 12
-
IGEL OS 11
Details
It has been discovered that the DOM: Navigation component in Firefox ESR is affected by a privilege escalation (CVE-2026-124854, high) and a sandbox escape (CVE-2026-124855, high). Furthermore, many use-after-free issues have turned up, among others in Audio/Video (CVE-2026-124865, high), Layout (CVE-2026-124866, high), and in Networking: Cookies (CVE-2026-124894, high).
Besides this, compromised intermediate eMudhra certificates, already deactivated via a revocation mechanism, are now permanently blocked (CVE-2026-113470, high).
In total, over 200 issues have been fixed. Details can be found in the Mozilla Foundation Security Advisories referenced.
Update Instructions
-
OS 12: Upgrade the Firefox ESR app to version 153.7.0 as soon as it is available on the IGEL App Portal.
-
OS 11: IGEL OS 11 reached End of Maintenance in June 2026. To ensure continued access to security updates and support, we recommend migrating to IGEL OS 12.
References
-
MFSA 2026-127: https://www.mozilla.org/en-US/security/advisories/mfsa2026-127/
-
MFSA 2026-120: https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/
-
MFSA 2026-112: https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/
-
MFSA 2026-100: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/