Firefox 160 fixes 99 flaws, a dozen of them sandbox escapes

Firefox 160 fixes 99 flaws, a dozen of them sandbox escapes

10 November 2026: Mozilla has fixed 99 vulnerabilities in Firefox 160 and 81 in Firefox ESR 153.7, the extended-support build most managed fleets run, with 57 of the Firefox 160 entries rated high. Twelve of the Firefox 160 entries are sandbox escapes, the class of bug that lets code break out of the content process an attacker reaches through a web page.

Not yet independently verified. The counts are ours, taken from the CVE sections on each Mozilla advisory page; Mozilla publishes no summary count, and we have seen no independent write-up yet. We will update this when it can be confirmed, and remove this note.

How the counts break down

Counted from the CVE sections on each advisory page:

Advisory	Product	Entries	High	Moderate	Low
MFSA 2026-125	Firefox 160	99	57	24	18
MFSA 2026-127	Firefox ESR 153.7	81	51	21	9
MFSA 2026-126	Firefox ESR 115.45	28	28	0	0
MFSA 2026-128	Thunderbird 160	103	59	27	17
MFSA 2026-129	Thunderbird 153.7	86	52	25	9

Mozilla rates each of the five advisories high overall. No entry is rated critical, and none of the pages says a flaw has been exploited. Since Firefox 159 Mozilla has given each memory safety bug its own CVE instead of rolling them into one combined entry, which is why the totals look so large next to older releases. A separate advisory, MFSA 2026-124, covers Firefox for iOS 160.0.

The sandbox escapes and what else is in Firefox 160

The first entries in the Firefox 160 list set the tone. CVE-2026-124853 is a sandbox escape through incorrect boundary conditions in the Graphics: Text component, and it also appears in ESR 153.7. CVE-2026-124854 is a privilege escalation in DOM: Navigation, and CVE-2026-124855 a sandbox escape in the same component. Further escapes sit in the Storage: Cache API, the cubeb audio library and Service Workers. Of the 99 entries, 35 are use-after-free bugs, spread across the HTML parser, Canvas2D, layout, the editor and the cycle collector, and one, CVE-2026-124874, is a same-origin policy bypass in Networking: HTTP.

What managed fleets should push

Organisations on the rapid release channel move to Firefox 160. Fleets on the extended support release move to 153.7, and the few still on the 115 branch, kept alive for older operating systems, move to 115.45, which fixes 28 high-rated flaws on its own. Thunderbird users take 160 or 153.7. Enterprise policies that pin a version, or that hold updates for testing, need releasing; Mozilla's advisories give no workaround short of updating.

Our catalogue lists Firefox Enterprise, the managed deployment of the browser.

Sources

• Mozilla Foundation Security Advisory 2026-125: Firefox 160, 10 November 2026
• Mozilla Foundation Security Advisory 2026-127: Firefox ESR 153.7, 10 November 2026
• Mozilla Foundation Security Advisory 2026-126: Firefox ESR 115.45, 10 November 2026
• Mozilla Foundation Security Advisory 2026-128: Thunderbird 160, 10 November 2026
• Mozilla Foundation Security Advisory 2026-129: Thunderbird 153.7, 10 November 2026