# Firefox 138.0.4/128.10.1esr (Pwn2Own Releases)

**URL:** https://discourse.nixos.org/t/firefox-138-0-4-128-10-1esr-pwn2own-releases/64442
**Category:** Security
**Created:** [May 18, 2025, 10:19pm UTC](https://discourse.nixos.org/t/firefox-138-0-4-128-10-1esr-pwn2own-releases/64442 "2025-05-18T22:19:50Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bme](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/b/d2c977/32.png) [@bme](https://discourse.nixos.org/u/bme)
#### Post date: [May 18, 2025, 10:19pm UTC](https://discourse.nixos.org/t/firefox-138-0-4-128-10-1esr-pwn2own-releases/64442/1 "2025-05-18T22:19:50Z")

</div>

> **[Security Vulnerabilities fixed in Firefox 138.0.4](https://www.mozilla.org/en-US/security/advisories/mfsa2025-36/)**

Seems like it’s worth mentioning here that as soon as the builds lands people should be upgrading.

---

<div class="post-metadata">

### Author: ![picnoir](https://discourse.nixos.org/user_avatar/discourse.nixos.org/picnoir/32/4186_2.png) [@picnoir](https://discourse.nixos.org/u/picnoir)
#### Post date: [May 18, 2025, 10:22pm UTC](https://discourse.nixos.org/t/firefox-138-0-4-128-10-1esr-pwn2own-releases/64442/2 "2025-05-18T22:22:40Z")

</div>

Unstable: [Nixpkgs PR #408236 ("firefox{,-bin}-unwrapped: 138.0.3 -\> 138.0.4") progress](https://nixpk.gs/pr-tracker.html?pr=408236)  
25.05: [Nixpkgs PR #408337 ("[Backport release-25.05] firefox{,-bin}-unwrapped: 138.0.3 -\> 138.0.4") progress](https://nixpk.gs/pr-tracker.html?pr=408337)

---

<div class="post-metadata">

### Author: ![wamserma](https://discourse.nixos.org/user_avatar/discourse.nixos.org/wamserma/32/5353_2.png) [@wamserma](https://discourse.nixos.org/u/wamserma)
#### Post date: [May 18, 2025, 10:52pm UTC](https://discourse.nixos.org/t/firefox-138-0-4-128-10-1esr-pwn2own-releases/64442/3 "2025-05-18T22:52:22Z")

</div>

24.11: [Nixpkgs PR #408350 ("[Backport release-24.11] firefox{,-bin}-unwrapped: 138.0.3 -\> 138.0.4") progress](https://nixpk.gs/pr-tracker.html?pr=408350)

---

<div class="post-metadata">

### Author: ![dtomvan](https://discourse.nixos.org/user_avatar/discourse.nixos.org/dtomvan/32/31095_2.png) [@dtomvan](https://discourse.nixos.org/u/dtomvan)
#### Post date: [May 20, 2025, 6:47pm UTC](https://discourse.nixos.org/t/firefox-138-0-4-128-10-1esr-pwn2own-releases/64442/4 "2025-05-20T18:47:40Z")

</div>

I have a question: I am on `devedition` (unrelated: to make extensions built from source with nix work) but the version is `139.0b3`. How do I know wether or not I also have these fixes? I don’t think it says explicitly anywhere on mozilla’s websites, and the reports aren’t public.

They do mention though: `Version 138.0.4, first offered to Release channel users on May 17, 2025`  
And: `Version 139.0beta, first offered to Beta channel users on April 29, 2025`

So it seems like `139.0beta` doesn’t have the fixes, but `139.0b3` might? All kinda vague. I guess [Milestones and key data for Firefox 139](https://whattrainisitnow.com/release/?version=139) says that the last merge from `mozilla-central` was 3 weeks ago though, so that would indicate it isn’t included.

All in all, how do I, if not using the main release train, know that I have the latest security fixes?