Check your readiness

Is Mozilla Firefox supported for Cyber Essentials?

Web browser · Mozilla2 of 3 versions supportedChecked 3 November 2026

Vendor end-of-support dates by version, and what the security update management control requires if you are past one.

Check a productCheck your readiness
Key factsA6.2
Status
2 of 3 versions supported as of 3 November 2026
Next end of support
7 September 2027 (Firefox ESR 153 (current ESR))
Vendor
Mozilla
Category
Web browser
Questions
A6.2A6.2.1A6.5AUTO-FAIL
Source
Vendor lifecycle page
CE Plus test
Test case 2: authenticated vulnerability scan
Short answer

Partly. As of 3 November 2026, 2 of 3 listed Mozilla Firefox versions are supported for Cyber Essentials. Firefox ESR 140 and earlier no longer receive security updates and fail A6.2. The next listed end of security updates is 7 September 2027 (Firefox ESR 153 (current ESR)).

Support status

Is Mozilla Firefox supported for Cyber Essentials?

Partly. 2 of 3 listed Mozilla Firefox versions were supported on 3 November 2026; the table shows which.

Firefox is supported on the current release or the current Extended Support Release (ESR). In November 2026 the current ESR line is 153, scheduled to run to September 2027; ESR 140 received its last update alongside Firefox 157 on 29 September 2026. Firefox must auto-update to stay supported for A6.2 and A6.2.1.

Versions

Which Mozilla Firefox versions are supported?

Rapid Release (current release), Firefox ESR 153 (current ESR) are supported as of 3 November 2026. Firefox ESR 140 and earlier is past end of support.

VersionUpdates endCyber EssentialsNote
Rapid Release (current release)No fixed date (rolling)PassNew release every two weeks; Firefox 159 shipped on 27 October 2026 and 160 is due on 10 November 2026.
Firefox ESR 153 (current ESR)7 September 2027PassMozilla's calendar shows the last 153.x update shipping with Firefox 180 on 7 September 2027.
Firefox ESR 140 and earlier29 September 2026FailLast 140.x update shipped with Firefox 157.

Source: https://whattrainisitnow.com/calendar/. Last checked 3 November 2026.

How to check

How do you check which Mozilla Firefox version you are running?

You need the exact version for the device and software lists in the question set, and to compare against the table above. Check each in-scope device, or export the version column from your device management tool.

  1. Open the menu > Help > About Firefox. The window shows the version and downloads any pending update.
  2. An ESR install shows esr after the version number.

Record the version with the date you checked it. That dated record is the evidence behind your A6.2 answer and the version lists in A6.2.1 to A6.2.4.

Definition

What does "supported" mean under A6.2?

Supported means a vendor still issues regular security updates for the version and has published the date it will stop. Past that date, the version is unsupported.

The requirements define licensed and supported software as software you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes, where the vendor provides the future date they will stop. Extended support counts while you can evidence the entitlement. Once the date passes, the software is unsupported whatever it still does.

Question A6.2 asks whether all software on in-scope devices are supported by a vendor that produces regular security updates. It applies to every device in scope, including staff-owned devices under BYOD, and to firewall and router firmware, which the A6.1 guidance treats as an operating system. The same guidance lists Windows 10, macOS Ventura, iOS 15 and Android 12 among its examples of operating systems out of regular support. Paid extensions such as Extended Security Updates count while you can show the licence.

How assessors check this
Assessors compare the versions you list in A2.6 to A2.8 and A6.2.1 to A6.2.4 against the vendor's lifecycle page. A version number you cannot state is treated as a version you cannot evidence.
Next steps

What happens if Mozilla Firefox is unsupported?

An unsupported Mozilla Firefox version on any in-scope device stops the assessment passing: A6.2 cannot be answered Yes, and A6.3 would be a Yes, which means the licensed-and-supported requirement is not met. It is not labelled an automatic fail, but the assessor will not pass the application until it is fixed. There are three ways to fix it; pick one per device before you submit.

  1. Upgrade to a supported version. This is the answer for almost every laptop, desktop and server. For applications with a paid extension, enrol and keep the proof.
  2. Remove the software from in-scope devices, and answer yes to A6.6.
  3. Move the device into a defined sub-set that prevents all traffic to or from the internet, describe how in A2.2.2, and declare it under A6.7. A sub-set is segregated by a firewall or VLAN. It is a last resort for equipment that cannot be upgraded.
Common failure
Declaring an unsupported device out of scope without segregating it. If it shares a network with in-scope devices and can reach the internet, it is in scope and fails A6.2.
Cyber Essentials Plus

How does Cyber Essentials Plus check this?

Test case 2 checks it: an authenticated vulnerability scan of sampled end-user devices, servers and IaaS instances. The sub-test fails if the scan finds a vulnerability rated critical or high risk by the vendor, scored 7 or above on CVSS v3, or with no severity given, where the vendor fix has been available for more than 14 days.

The test specification adds that virtual patching is not accepted as a long-term mitigation for legacy unsupported operating systems. The Plus audit tests the same scope as the self-assessment certificate, so fix unsupported software before the self-assessment, not after.

FAQ

Frequently asked questions

Partly. 2 of 3 listed Mozilla Firefox versions were supported on 3 November 2026; the table shows which. Firefox is supported on the current release or the current Extended Support Release (ESR). In November 2026 the current ESR line is 153, scheduled to run to September 2027; ESR 140 received its last update alongside Firefox 157 on 29 September 2026. Firefox must auto-update to stay supported for A6.2 and A6.2.1.

Licensed and supported software is software you have a legal right to use and that a vendor has committed to support with regular vulnerability fixes, with a published future date when they will stop. Extended support still counts. A version past its end-of-support date, or on a paid extension you cannot evidence, is unsupported.

The assessment will not pass until you fix it: A6.2 cannot be answered Yes, and A6.3 (unsupported software in scope) would have to be answered Yes. A6.3 is not labelled an automatic fail, but a Yes means the requirement that all in-scope software is licensed and supported is not met. The three fixes are: upgrade to a supported version, remove the software from in-scope devices, or move those devices into a sub-set with no internet access and declare it under A6.7.

Yes, indirectly. Test case 2 is an authenticated vulnerability scan of sampled devices. Any critical or high-risk vulnerability, or one with a CVSS v3 score of 7 or above, where the vendor fix has been available for more than 14 days fails the sub-test. The specification also states that virtual patching of legacy unsupported operating systems is not accepted.

The dataset was last checked on 3 November 2026 against the vendor lifecycle page linked on this page. Vendors change dates, so confirm against the source before relying on a date near your assessment.

Related pages

Sources
Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh