Firefox ESR End of Life & Support Options: What To Do When ESR Patches Stop (140 ESR Ends September 29, 2026)

By Scott Bissett  ·  Last updated: September 5, 2026  ·  Every date verified against Mozilla's release calendar — how we verify

Firefox 140 ESR reaches end of life on September 29, 2026. That is the day Mozilla ships the last 140 point release, alongside Firefox 156; from then on the only Extended Support Release receiving security updates is Firefox 153 ESR, released July 21, 2026. Every earlier ESR is already unsupported, with one deliberate exception: Firefox 115 ESR keeps getting updates until March 31, 2027 for the older Windows and macOS versions that later releases no longer run on.

For a managed fleet this is a real event rather than a browser update. ESR is the channel enterprises deploy precisely because it does not change every four weeks; when an ESR line ends, every machine still on it stops receiving fixes for a component that renders untrusted content all day. The overlap between two ESRs is the window Mozilla gives you to qualify the new line, update policies and roll it out. This page is the reference for every Firefox ESR line, the cycle behind the dates, and what to do when an ESR's patches stop.

Key Dates at a Glance

• Firefox ESR 140: end of life 2026-09-29
• Firefox ESR 128: end of life 2025-09-16
• Firefox ESR 115: end of life 2027-03-31
• Firefox ESR 102: end of life 2023-09-26
• Firefox ESR 91: end of life 2022-09-20
• Firefox ESR 78: end of life 2021-11-02

Every Firefox ESR line: release and end-of-life dates

Mozilla designates one major release a year as the Extended Support Release. The table lists every ESR line we track, from the current one down; the dates are bound to the same data as the Firefox product page and re-verified at each build. Scores are live EOL Risk Scores™ — click any for the breakdown.

Every Firefox ESR, one line each

The same schedule as plain statements, one per ESR line, for anyone who needs a single date rather than a table. Every date is bound to the data layer and checked against Mozilla's release calendar at each build.

• Firefox 153 ESR — released July 21, 2026; the current ESR, with no end date announced yet.
• Firefox 140 ESR — released June 24, 2025; end of life September 29, 2026.
• Firefox 128 ESR — released July 9, 2024; end of life September 16, 2025.
• Firefox 115 ESR — released July 4, 2023; end of life March 31, 2027.
• Firefox 102 ESR — released June 28, 2022; end of life September 26, 2023.
• Firefox 91 ESR — released August 10, 2021; end of life September 20, 2022.
• Firefox 78 ESR — released June 30, 2020; end of life November 2, 2021.

How the Firefox ESR cycle works

Mozilla ships mainstream Firefox every four weeks and promotes one release a year to Extended Support Release status. An ESR line then receives security and stability point releases on the same four-week rhythm, without the feature changes of the mainstream channel. When the next ESR is promoted, the outgoing line continues to receive updates for a few more release cycles so that organisations can test and deploy the new one; after the last of those updates, the line is end of life. This cycle's overlap runs from the release of Firefox 153 ESR on July 21, 2026 to the final Firefox 140 ESR update on September 29, 2026.

Two things follow from that shape. An ESR line is supported for roughly a year plus the overlap, never longer, and the end date is known months ahead from the release calendar; there is no long-term support tier beyond ESR and no paid extension. And because a new ESR is a new major version, the move is a qualification exercise — enterprise policies, extensions, internal web applications and kiosk setups all need a pass on the new line before the fleet flips.

The Firefox 115 ESR exception

Firefox 115 ESR would normally have ended when 128 ESR's overlap closed. Mozilla kept it alive because the releases that followed 115 dropped support for older versions of Windows and macOS, leaving machines on those systems with no newer Firefox to run. Firefox 115 ESR therefore continues to receive security updates until March 31, 2027, and only on those platforms. It is a security bridge for hardware that cannot move, not a supported line for anything that can run 153 ESR.

What to do when a Firefox ESR reaches end of life

1. Inventory by ESR line, not by “Firefox”. Your management tool's installed-software report will show mainstream and ESR builds together; filter on the ESR suffix and group by the first version number. Anything on 140 or older is on the clock.
2. Qualify the current ESR now. Firefox 153 ESR has been available since July 21, 2026. Test policies (the enterprise policy templates change between majors), extensions, single-sign-on and any internal application that pins a browser version, then update the deployment package.
3. Roll out before September 29, 2026, not after. The overlap is the migration window; once the last 140 update ships, every day on 140 is a day with unpatched browser vulnerabilities on the machines that face the web most.
4. Treat 115 ESR machines as a separate project. They exist because the operating system underneath cannot run a newer Firefox. The browser date (March 31, 2027) is a symptom; the fix is the operating system, and that migration takes longer than a browser rollout.
5. Put the next date in the calendar. ESR lines end on a predictable annual rhythm; the 153 line will be replaced the same way. A fleet that schedules the annual ESR move as routine maintenance never meets this page in an emergency.

Support options when patches stop

Unlike an operating system or a database, an end-of-life Firefox ESR has no extended-support market: Mozilla publishes fixes only for the current ESR and, during the overlap, the previous one, and we know of no vendor that sells patches for an older line. The options are therefore short. Upgrade to the current ESR, which is free and the only supported path. Where the operating system is the blocker, the 115 ESR run to March 31, 2027 buys time for the OS migration, not a reprieve from it. Where a legacy web application will not work on a current browser, isolate that application (a dedicated, network-restricted machine or virtual desktop) rather than holding the whole fleet on an unpatched ESR.

Frequently Asked Questions

Related Resources

• Firefox lifecycle: every release and ESR line with live dates and risk scores
• Firefox 140 ESR: end-of-life date and risk score
• Firefox 153 ESR: the current Extended Support Release
• Windows 10 End of Life: the operating-system deadline behind many stranded browsers
• EOL Watch: upcoming end-of-life deadlines