Mozilla shipped Firefox ESR 115.43 on Oct. 13 with fixes for 17 security vulnerabilities, 16 of them rated high and one moderate. Five of the 16 high-rated bugs were reported by a single outside researcher, Amy Burnett of OpenAI, who is credited by name in the advisory.
ESR stands for Extended Support Release, the slower-moving branch of Firefox that organizations and users on older operating systems rely on. This build is the one for machines that cannot run current Firefox, so its advisory carries more weight than its small size suggests.
16 high-severity bugs in a 17-fix advisory
The advisory, MFSA 2026-107, rates the overall impact high and lists 17 CVEs: 16 rated high and one rated moderate. Ten of the 17 are use-after-free bugs, a class of memory error in which a program keeps using memory after it has been released, and which attackers often turn into code execution. Affected components include IndexedDB storage, graphics text rendering, XML, SVG, audio and video, DOM animation and DOM streams.
The one moderate entry is CVE-2026-109753, an incorrect-boundary-conditions bug in the Layout component. Everything else on the list sits in the high tier, so the severity split is heavily lopsided. By the advisory’s own attribution, Mozilla credits itself with nine of the 17 reports, outside researchers with the other eight, and Burnett is the largest single outside name with five.
Sorted by type, the list is dominated by one failure mode. Besides the ten use-after-free bugs, the advisory records two incorrect-boundary-conditions bugs in the JavaScript engine and a third, the moderate one, in Layout. It adds two just-in-time compiler miscompilations, one integer overflow in Graphics and the single sandbox escape. That adds up to 17 and shows a browser whose risk is concentrated in memory handling inside the rendering and scripting engines rather than in features or settings.
The graphics sandbox escape
The entry that stands apart is CVE-2026-109712, which the advisory describes as a sandbox escape due to uninitialized memory in the Graphics component. Mozilla’s own team reported it, and it is rated high. Sandbox escapes matter because Firefox runs web content in a restricted process; a bug that lets code break out of that process is the second half of an attack that begins with a browser compromise.
Other graphics entries in the list include CVE-2026-109710, a use-after-free in Graphics: Text, and CVE-2026-109730, an integer overflow credited to Robert Longson. CVE-2026-109719, a race condition and use-after-free in CanvasWebGL, came from Shu Takahashi of Velcore Consulting Inc., and CVE-2026-109729, a use-after-free in the JIT compiler, came from Tomer Fichman.
Five bugs from an OpenAI researcher
Burnett’s credits are the most distinctive feature of the advisory. Five of the 16 high-severity bugs carry her name: CVE-2026-109715 and CVE-2026-109716, both incorrect boundary conditions in the JavaScript engine; CVE-2026-109722 and CVE-2026-109733, two just-in-time compiler miscompilations; and CVE-2026-109728, a use-after-free in DOM animation. Mozilla’s Firefox 158 advisory, MFSA 2026-106, credits her with nine reports, so the same researcher accounts for a sizable share of the outside findings in both releases.
The two JIT miscompilations are the ones most worth noticing, since a flaw in how a compiler translates JavaScript into machine code can let a malicious script write where it should not. The remaining outside reporters on the ESR list are Takahashi, Fichman and Longson, each credited with one bug. The advisory does not describe how any of them found their bugs.
The scale of the ESR 115 fix list is small beside its siblings. PCWorld counts 77 flaws in Firefox 158 and 61 fixes in ESR 153.5.0, against 17 here, which fits a branch that receives only the backports that apply to its older code. The 115 release is also one of the few remaining routes for users of Windows 7, Windows 8.1 and macOS 10.12 through 10.14 to receive Mozilla security patches, so each advisory carries more practical weight for them than the raw count implies.
Who still runs this branch
PCWorld’s roundup reports that Firefox ESR 115.43.0 contains 17 fixes, supports only Windows 7 and 8.1 and macOS 10.12 through 10.14, and will remain available until March 2027. The same article says ESR 140 got its final update on Sept. 29. The current extended-support line, ESR 153.5.0, was released the same day; Mozilla’s enterprise release notes list it as dated Oct. 13, 2026, and the regular browser reached version 158, whose release notes are dated the same day.
Mozilla’s advisories now follow a policy it states directly: it no longer rolls “all internally identified memory safety vulnerabilities into a single CVE.” That is why a modest-looking ESR build produces 17 separate identifiers, and it means the count says more about how Mozilla books its fixes than about any sudden surge in flaws. Users on the 115 branch have a firm end date to plan around, with support lasting only until March 2027.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
