How to match Firefox and Firefox ESR security advisories to your browser

Advisory matching record

Start with the browser you actually run

Match a Mozilla security advisory to your installed product, release channel, branch, operating system, and version, then install and verify the appropriate supported update. Mozilla publishes advisories for several products and release lines, including Firefox and Firefox Extended Support Release, usually called ESR. A Firefox headline alone is not a complete update instruction. Recording the installation details avoids treating a higher regular Firefox version as proof that ESR is obsolete, or assuming an ESR update fixes a separate mobile installation. Use the live advisory pages when making a decision; a historical fixed version is not a current maintenance target.

Check the installed version and channel

Collect the complete running version and channel from the browser’s version information or your administrator’s inventory, rather than recording only the major number. Also record the operating system, package provider, and device or deployment group. If several Firefox installations exist, inspect the one you actually launch; a downloaded installer does not establish the running version. Ask the administrator to resolve an ambiguous channel before choosing a target. Keep the observed version separate from the version scheduled for deployment so that an intended update is not accidentally reported as completed.

Read the advisory fields before the vulnerability list

Start at Mozilla Foundation Security Advisories and open the relevant entry. Check its announcement date, Products field, and Fixed in list before reading individual issues. A Mozilla Foundation Security Advisory identifier refers to the advisory document; CVE identifiers refer to individual vulnerabilities described within it. One document can cover multiple issues, and related products can have separate documents. Match the fixed release to your own supported branch rather than comparing unrelated major numbers. If an older installation spans several updates, review the intervening advisories as well. The newest entry alone is not necessarily a complete inventory of fixes missing from that installation.

Keep platform scope and release channels separate

Read each issue for platform restrictions or configuration conditions. A Windows-specific description does not automatically apply to macOS or Linux, while an issue without such a restriction should not be dismissed merely because another item names Windows. Firefox for Android and Firefox for iOS can have their own advisory entries; desktop ESR numbers are not a mobile update target. Beta, Developer Edition, and Nightly are also distinct channels, so do not infer their patch status from a desktop release headline alone. For Linux distribution packages or store-managed installations, consult the package provider when its update delivery or version labeling differs from Mozilla builds.

Understand what ESR gives you

Mozilla describes ESR as a stability-oriented release line with annual major releases and incremental security updates between them. Keeping feature changes less frequent can reduce repeated compatibility checks for internal applications, extensions, and training materials. Regular Firefox delivers features and improvements more frequently, which can suit people who need newer web capabilities sooner. ESR is not a security guarantee, a frozen browser, or permission to postpone security updates. It still needs timely maintenance, and its older feature baseline can have compatibility limitations. Choose the channel around operational needs, then maintain that channel rather than assuming one label eliminates browser risk.

Check support separately from the ESR label

An ESR installation does not receive support indefinitely. Check the lifecycle information for its particular branch and operating system, including any transition period or platform-specific extension Mozilla announces. Support availability varies, so an old download remaining accessible is not evidence of ongoing security maintenance. Plan a supported branch transition before maintenance ends, with time to check essential applications. Browser updates also do not repair an unsupported operating system. If the installed platform cannot run a supported browser line, treat that as a migration requirement to discuss with the device owner or administrator, rather than assuming ESR supplies permanent coverage.

Confirm who controls automatic updates

Automatic updating reduces routine work, but its presence does not prove an update has finished. Mozilla documents AppAutoUpdate as controlling automatic application installation; the operating system can still require approval. DisableAppUpdate can override that behavior. Managed organizations may use separate deployment systems, and Linux packages may receive updates through their distribution. Keep normal automatic updates enabled on personally managed installations, and follow the approved update process on managed devices. If settings are locked or delivery stalls, ask the administrator to confirm deployment status. Resolve the delivery problem through the supported updater or package manager instead of changing security settings to force progress.

Work through a historical advisory

MFSA 2024-51, announced October 9, 2024, is a useful historical example. It names Firefox and Firefox ESR, rates CVE-2024-9680 critical, and lists fixes in Firefox 131.0.2, ESR 128.3.1, and ESR 115.16.1. Mozilla describes a use-after-free in Animation timelines and reports exploitation in the wild. For an ESR 128 installation at that time, the relevant listed fix was 128.3.1, not regular Firefox 131.0.2. These exact numbers illustrate branch matching only: none is a current patch target. The advisory’s exploitation statement establishes urgency in that historical context, not proof that a particular device was compromised.

Close the update with evidence

After installation and any required restart, check the running version again. Keep the advisory URL, product and channel, operating system, review date, and update outcome together. For a managed fleet, distinguish update offered, downloaded, installed, and running after restart; these are different states. Mozilla impact ratings help prioritize work but do not, by themselves, establish active exploitation or device compromise. Look for an explicit exploitation statement, as in the historical example, rather than inferring one from a critical rating. Record uncertainty if applicability remains unclear and seek vendor or administrator clarification. A useful recurring review ends with a supported running release and a traceable decision.

Primary sources and methodology

Documentation-based guide reviewed on 2026-11-03 using the accessible official Mozilla advisories, release-channel guidance, download information, and update-policy reference listed below. The worked example reproduces MFSA 2024-51’s historical date, CVE, and fixed-version fields; it does not recommend those versions today. Inventory and verification steps are operational recommendations. No hands-on browser, exploit, or deployment tests were performed.

• Mozilla Foundation Security Advisories: product entries and impact definitions
• Mozilla MFSA 2024-51: historical Products, Fixed in, and exploitation example
• Mozilla security advisories organized by Firefox ESR fixed release
• Firefox administrator reference: choosing a release channel
• Firefox administrator reference: AppAutoUpdate policy
• Mozilla Firefox downloads: Firefox and ESR release models