Mozilla Releases Firefox 153 Fixing 63 Vulnerabilities Including Critical ESR Issues
Mozilla Foundation has released Firefox 153 along with an updated Firefox ESR branch on July 21, 2026, resolving multiple security vulnerabilities.
The stable channel update addresses 63 CVEs and is rated High overall, while the ESR version fixes publicly exploitable flaws classified as Critical.
Twenty of the issues carry a High severity rating. These include a same-origin policy bypass in navigation handling tracked as CVE-2026-16349 and several memory-safety vulnerabilities.
Additional High-severity fixes cover a Use-After-Free flaw (CVE-2026-16362) and multiple sandbox escape vulnerabilities: CVE-2026-16351, CVE-2026-16352, CVE-2026-16356, and CVE-2026-16367.
The advisory also resolves boundary-condition errors, integer overflows, miscompilation problems, privilege-escalation vectors, and information-disclosure issues.
Thirty-five Moderate and eight Low severity vulnerabilities were likewise patched in the release.
Related articles
SonicWall Global Management System Hit by Critical RCE and Path Traversal Vulnerabilities
SonicWall has disclosed six vulnerabilities in its SonicWall Global Management System (GMS) management product, with the highest-severity issues rated Critical. The most severe flaw, CVE-2026-66147, resides in the Dispatcher Service and allows unauthenticated remote code execution through crafted requests that inject commands. A second critical issue, CVE-2026-66145, stems from improper handling of zip archive extraction and enables path traversal attacks that can read sensitive data or write arbitrary files without authentication. Both vulnerabilities received CVSSv3 base scores above 9.0. The flaws affect both the virtual appliance and Windows versions of GMS. SonicWall released an advisory on August 11 urging immediate application of the available updates.
Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities
Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.
Compromised SIM Cards Exploit Proactive SIM to Steal Files, Execute Code and Force 2G on Smartphones and IoT Devices
Researchers from the University of Birmingham and Fuzzware have demonstrated that a compromised SIM card can issue commands to smartphones and IoT devices by abusing the standard Proactive SIM feature. The attack leverages the RUN AT command to force the modem to execute AT commands, creating a direct channel from the SIM to the device hardware. Using their CATana toolkit, the team tested 18 smartphones and eight cellular IoT devices, finding the AT command interface exposed on two phones and seven IoT units. Four vulnerabilities were identified, enabling code execution, file theft, denial of service and persistent downgrade to 2G. Affected devices include the OPPO Reno14 F 5G and Quectel-based modules such as the EC25-AFX and EG25-G. Manufacturers have released some patches, and GSMA has registered the issue as CVD-2026-0122, though researchers recommend removing the RUN AT function entirely from firmware.
Russian Researchers Patent Detector Blinding Protection for Quantum Key Distribution Systems
Engineers from SFB Lab and the Center for Quantum Technologies at Moscow State University have developed a new method to protect quantum key distribution systems against detector blinding attacks. The technique not only detects the attack but also preserves the secure portion of the generated key instead of discarding the entire key after an alarm. The approach works by randomly varying the quantum efficiency of single-photon detectors at the receiver side, forcing an attacker to leave detectable traces such as erroneous or double clicks. These statistical anomalies allow the system to estimate the number of potentially compromised bits and remove them during privacy amplification. The solution has been granted Russian patent RU 2 856 208 C1 and accepted for publication in Physical Review Applied. It was validated on commercial off-the-shelf detectors and requires no changes to the optical scheme, making it compatible with a wide range of existing QKD hardware.