Build an applicability worksheet
| Record | Why it matters |
|---|---|
| Official advisory URL and announcement date | Pins the claim to a particular notice. |
| Product and channel | Firefox and Firefox ESR have separate release records. |
| Running version | Establishes the actual installation you are assessing. |
| Fixed-version and affected-scope wording | Provides the source’s stated boundary; read each relevant entry. |
| Platform qualifications and exploitation statement | Avoids treating a headline as a universal diagnosis. |
| Updater or administrator | Identifies who can apply the supported update. |
Use the installation guide to find the version and update authority. Do not compare Release and ESR numbers as though they were a single sequence.
Two historical examples of the same date
| Advisory | Product | Fixed in | Impact |
|---|---|---|---|
| MFSA 2025-07 | Firefox | Firefox 135 | High |
| MFSA 2025-09 | Firefox ESR | Firefox ESR 128.7 | High |
Both notices were announced on 4 February 2025. They show why product matching comes before version comparison: one states a Firefox fix, the other an ESR fix. A reader checking an ESR installation needs the ESR notice and its relevant vulnerability entries, not the Release number from a headline.
Work through the product match before comparing numbers
| Reader installation | Which notice applies? | What can be concluded |
|---|---|---|
| Firefox 134, Release | MFSA 2025-07, which names Firefox and a fix in 135. | Read the affected entries and apply that product’s supported update route; this historical fix level was not yet reached. |
| Firefox ESR 128.7 | MFSA 2025-09, which names Firefox ESR and a fix in ESR 128.7. | That installation matches this historical fixed-version field; current advisories still require a new check. |
Mozilla advisory 2025-07 · Mozilla advisory 2025-09
The common mistake is to compare the ESR reader’s 128 with the Release notice’s 135 and decide on that numerical difference alone. Matching the product first produces a usable record; different channels are not a single version-number ladder.
Read what the source actually establishes
Separate a notice’s severity label from any statement that a vulnerability has been exploited. A “fixed in” field is also not a complete list of every affected platform and version. Read the individual entries and caveats before answering a specific installation question. If the source does not settle that question, leave it open rather than infer that an omitted platform is safe.
Illustrative workflow: record your product and running version, locate the official notice for that product, note its fixed-version requirement, then follow the correct update authority. After the update and restart, check the running version again. Find your Firefox version
Use current guidance for the actual action
Use Mozilla’s current advisory and update information for today’s installation. The historical examples above explain the format and do not replace that check. For a managed device, bring the advisory to the administrator. Update Firefox to the latest release
Changing channels, installing an old browser or disabling updates does not follow from an alarming headline. If the update is applied but a separate browser symptom remains, investigate that symptom on its own rather than assuming the notice diagnoses it.
Sources & scope
Source checks are dated individually below. Interface labels and availability may vary by version and platform. This guide is based on checked product documentation.
- Mozilla advisory 2025-07 Advisory header · Checked 2026-10-07
- Mozilla advisory 2025-09 Advisory header · Checked 2026-10-07
- Find your Firefox version Version identification · Checked 2026-10-07
- Update Firefox to the latest release Installation-source notes and Update Firefox · Checked 2026-10-07
Source review: Firefox Updates Verification Desk, an automated editorial role. Read the AI and verification disclosure.