The current version of Firefox ESR is 140.17.0esr (as of 30/09/2026). patchletter checks the official source daily and emails you new releases.
Actively exploited vulnerabilities
The US cybersecurity agency CISA lists this vulnerability in its catalog of Known Exploited Vulnerabilities. What CISA does not carry does not appear in this list — even where it is being exploited.
- CVE-2016-9079Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
7.5 high · over the network, without login · CISA deadline was 13 Jul 23
Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.
BSI security advisories
Advisories the German BSI (CERT-Bund) published for this product. Whether your version is affected is stated in the advisory itself.
- Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen
WID-SEC-W-2026-3654 · 9 Oct
- Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
WID-SEC-W-2026-3375 · 9 Oct
- Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen
WID-SEC-W-2026-2911 · 8 Oct
- Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
WID-SEC-W-2026-3132 · 8 Oct
- Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
WID-SEC-W-2026-2458 · 8 Oct
- Mozilla Firefox und Firefox ESR: Mehrere Schwachstellen
WID-SEC-W-2026-1296 · 22 Sept
- Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
WID-SEC-W-2026-0997 · 22 Sept
- Mozilla Firefox und Mozilla Thunderbird: Mehrere Schwachstellen
WID-SEC-W-2026-0850 · 22 Sept
Firefox ESR at a glance
Firefox ESR (Extended Support Release) is the slow-cadence build of Firefox for organizations that need stability — feature changes land only about once a year, while security fixes arrive continuously via minor releases.
For admins ESR is the pragmatic choice where frequent feature jumps would disrupt users or embedded workflows. Security updates within an ESR line are low-risk and should be applied promptly (browsers are a top attack surface). The annual major-version bump to the next ESR is the point that warrants testing of extensions and enterprise policies. Manage it via policies.json/ADMX like regular Firefox. Watch the overlap window when an ESR line reaches end of life so you migrate before support stops.
Support cycles (endoflife.date)
| Cycle | Latest version | Status |
|---|---|---|
| 153 (aktueller ESR)LTS | 153.2.0 | – |
| 140LTS | 140.15.0 | EOL in 2 days |
| 128LTS | – | End of Life |
| 115 (nur Windows 7/8/8.1 und macOS 10.12-10.14)LTS | 115.40.0 | – |
Version history & changelog · as detected by patchletter
| Version | Channel | Date | Notes |
|---|---|---|---|
| 140.17.0esr | LTS | 30/09/2026 | – |
| 140.16.0esr | LTS | 16/09/2026 | – |
| 140.15.0esr | LTS | 02/09/2026 | – |
| 140.14.0esr | LTS | 19/08/2026 | – |
| 140.13.0esr | LTS | 22/07/2026 | – |
| 140.12.0esr | LTS | 08/07/2026 | – |
Frequently asked questions
- What is the latest version of Firefox ESR?
- Firefox ESR 140.17.0esr, released 30/09/2026. patchletter checks the vendor's official source daily for new releases.
- Where can I find the Firefox ESR release notes?
- The version history above links to the vendor's official release notes where the vendor publishes them. patchletter deliberately stores no vendor full texts.
- How do I get notified about new Firefox ESR updates?
- Tick Firefox ESR off in the catalogue and leave your address. From then on new versions go out by email — one at a time, or bundled in the daily or weekly digest.
An email as soon as a new Firefox ESR version ships
We reconcile the vendor source daily. When a new version appears, it lands in your inbox right away or bundled as a digest. The update email is free and ends with one click. Alerts about vulnerabilities and end of support are part of patchletter Pro.
Embed this badge
The badge shows the current Firefox ESR version and keeps it up to date. Anyone may embed it, no account needed.
[](https://patchletter.com/en/software/firefox-esr)https://patchletter.com/badge/firefox-esr.svgAlso available: ?v=eol (end of support) and ?v=cve (actively exploited).
