Firefox 159 fixes 167 CVEs, 108 rated high, including sandbox escapes (MFSA 2026-118)

What happened

On 27 October 2026, Mozilla released Firefox 159 with 167 CVEs: 108 rated high, 52 moderate and 7 low, none critical (MFSA 2026-118). Mozilla no longer rolls memory-safety bugs into one combined CVE. Each bug now gets its own entry, which is part of why the count is so large.

The entries that matter most:

• CVE-2026-117861: sandbox escape in the DOM: Navigation component.
• CVE-2026-117864: sandbox escape in the Form Manager component.
• CVE-2026-117868: sandbox escape in the DOM: Networking component.
• CVE-2026-117860: same-origin policy bypass in the DOM: Navigation component.

All four are rated high (MFSA 2026-118). A sandbox escape is the step that turns a bug in a web page’s content process into access to the rest of the machine.

The same day Mozilla shipped Firefox ESR 153.6 (145 CVEs, including all four above) (MFSA 2026-120), Firefox ESR 115.44 (80 CVEs, five of them sandbox escapes, including CVE-2026-117868) (MFSA 2026-119), and Thunderbird 159 and 153.6 (Mozilla advisories).

Many bugs were found with AI tools. OpenAI Codex Security (kylebot) is credited on 34 entries, and Amy Burnett of OpenAI on 7 more. Mozilla’s own staff are credited on 102 (MFSA 2026-118).

The week before, Firefox 158.0.1 shipped an emergency certificate block. On 20 October, Mozilla fixed CVE-2026-113399, an SVG boundary bug rated high, and CVE-2026-113470 (MFSA 2026-111). Mozilla had blocked compromised eMudhra intermediate certificates through OneCRL on 17 October, delivered by Remote Settings. CVE-2026-113470 builds that block into the browser itself, so installs where Remote Settings is disabled by policy or cannot be reached still reject those certificates. The fix is in Firefox 158.0.1, ESR 153.5.1, ESR 115.43.1, Thunderbird 158.0.1 and 153.5.1 (CVE record).

Mozilla does not say any of these bugs were exploited.

Am I affected?

Any Firefox below 159, ESR 153 below 153.6, ESR 115 below 115.44, or Thunderbird below 159 or 153.6 is affected.

# Linux
firefox --version
thunderbird --version

# macOS
defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString

# Windows
(Get-Item "$env:ProgramFiles\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion

For the eMudhra block, check whether your Firefox enterprise policy (policies.json or Group Policy) turns off Remote Settings, or whether the machines cannot reach Mozilla’s update services. Those installs relied on 158.0.1 or later to get the block.

Also look beyond desktops: Firefox builds baked into CI images, Selenium grids and browser-testing containers are separate installs and usually do not auto-update.

What to do now

1. Update Firefox to 159. Organisations on the extended support release should move to ESR 153.6, or ESR 115.44 where 115 is still needed.
2. Update Thunderbird to 159 or 153.6. Thunderbird uses the same engine. The CVE records list Thunderbird 159 and 153.6 as fixed for CVE-2026-117860 and CVE-2026-117861 (CVE record).
3. Confirm the eMudhra block on locked-down installs. Where Remote Settings is disabled, anything older than Firefox 158.0.1, ESR 153.5.1 or ESR 115.43.1 still trusts the compromised intermediates. The 27 October releases include the fix.
4. Rebuild browser test images. Refresh Firefox in CI images and Selenium or other browser grids, since those copies do not update themselves.

Sources

• Mozilla MFSA 2026-118: Firefox 159
• Mozilla MFSA 2026-119: Firefox ESR 115.44
• Mozilla MFSA 2026-120: Firefox ESR 153.6
• Mozilla MFSA 2026-111: Firefox 158.0.1
• Mozilla security advisories index
• CVE record: CVE-2026-117861
• CVE record: CVE-2026-113470