openSUSE Firefox Update Closes 147 Flaws Including an Actively Exploited Brotli Bug
Our advisory VTA-2026-000503 of 2026-10-14 covered the SUSE Thunderbird update that closed more than one hundred Mozilla engine flaws. The incident has now moved on. openSUSE has published openSUSE-SU-2026:22308-1, rated important, which rebuilds MozillaFirefox on openSUSE Leap 16.1 to Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-120, bsc#1286955) and resolves 147 vulnerabilities together with two bug fixes. The important change for anyone who acted on the earlier advisory is the arrival of CVE-2026-111497, an out-of-bounds write in the brotli decoder that permits remote code execution, tracked separately as bsc#1287809. That flaw is confirmed exploited in the wild and carries SUSE scores of 8.1 under CVSS v3.1 and 9.2 under CVSS v4.0, making it the single item in this batch that changes the urgency picture rather than simply extending it.
The bulk of the 147 entries are memory-safety defects in the Gecko engine, and the advisory classifies them by component rather than by exploitation path. Use-after-free conditions dominate, appearing across the JavaScript garbage collector and JIT, the DOM core and HTML parser, the layout engine including text, fonts, grid, tables and scrolling, networking and HTTP, audio and video playback, CSS parsing, IndexedDB storage, XML and the Graphics ImageLib. Alongside these sit several sandbox escapes in the DOM Navigation, Form Manager and DOM Networking components, same-origin policy bypasses in DOM Navigation and CSS parsing, privilege escalation issues in the Networking, Graphics Canvas2D, WebRTC Networking and Windows DLL Services components, and uninitialised memory disclosure in Audio/Video and Canvas2D. CVE-2026-111497 is different in kind because brotli is a general-purpose compression library used for HTTP content encoding, so malformed compressed data reaching the decoder is the trigger surface. Beyond that component-level description, the vendor has not published per-CVE exploitation details, proof-of-concept code or indicators for this update, and none should be inferred from the component names alone.
The practical exposure is any openSUSE Leap 16.1 system with MozillaFirefox installed, which in most estates means staff desktops, jump hosts and developer workstations rather than servers. A browser that parses untrusted content from every site a user visits is the most reachable code on those machines, and the combination present here matters more than the raw count: memory corruption in the renderer paired with sandbox escapes in DOM Navigation and the Form Manager is the classic two-stage chain that turns a page visit into code running outside the content process. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 2026-10-27, and FIRST EPSS puts its probability of exploitation in the next thirty days at 82.6 percent, which is exceptionally high and reflects observed activity rather than theory. The remaining flaws with published scoring data look very different: CVE-2026-100801 sits at 0.3 percent, CVE-2026-117860 at 0.2 percent, CVE-2026-117861 through CVE-2026-117869 between 0.3 and 0.5 percent, and no exploitation evidence exists for the rest of the batch.
For a SOC weighing tonight against Monday, the distinction is the brotli flaw. The engine memory-safety fixes follow the normal Mozilla ESR cadence and carry no evidence of real-world use, but a KEV-listed remote code execution bug in a compression library invoked by ordinary web traffic is present danger on every unpatched Leap 16.1 endpoint. Because brotli decoding happens before most content-inspection logic and is negotiated transparently between browser and server, there is little user-visible signal when it is targeted. Unpatched hosts therefore remain reachable through routine browsing, and compromise of a workstation in this way yields credential material, session cookies and a foothold inside the trusted network segment.
Attack Surface
Web Browser, Endpoint, Endpoint OS
Tactics
Initial Access, Execution, Privilege Escalation, Defense Evasion
Techniques
- T1189 – Drive-by Compromise
- T1203 – Exploitation for Client Execution
- T1068 – Exploitation for Privilege Escalation
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- Apply openSUSE-SU-2026:22308-1 on all openSUSE Leap 16.1 hosts with `zypper in -t patch openSUSE-SU-2026-22308=1` or `zypper up MozillaFirefox`, which delivers Firefox 153.6.0 ESR (MFSA 2026-120, bsc#1286955) and closes all 147 CVEs in this batch.
- Treat CVE-2026-111497 (bsc#1287809) as the deployment driver rather than the bulk engine fixes – it is the brotli decoder out-of-bounds write added to CISA KEV on 2026-10-27, so schedule the Leap 16.1 desktop fleet ahead of the normal monthly window.
- Verify remediation per host with `rpm -q MozillaFirefox` and confirm the installed release is 153.6.0 ESR or later; flag any endpoint still reporting an earlier build in your CMDB or EDR software inventory.
- Confirm the openSUSE Leap 16.1 update repository is enabled and its metadata refreshed with `zypper ref` before deployment, since openSUSE-SU-2026:22308-1 is delivered only through that channel and hosts with stale metadata will not be offered MozillaFirefox 153.6.0 ESR.
- Cross-check the CVE list carried in openSUSE-SU-2026:22308-1 and MFSA 2026-120 against vulnerability-scanner and asset-management findings for the MozillaFirefox package on Leap 16.1, so that remediation of all 147 entries, including CVE-2026-111497 (bsc#1287809), is evidenced rather than assumed.
- Clear any zypper package lock or version pin on MozillaFirefox before patching Leap 16.1 workstations – check with `zypper locks` and release with `zypper removelock MozillaFirefox` – because a lock silently prevents openSUSE-SU-2026:22308-1 from installing Firefox 153.6.0 ESR.
- Force a browser restart after patching through managed policy or a logout notice, because running Firefox processes continue executing the vulnerable 153.5.x code until the session is terminated even after the RPM is replaced.
