Firefox 159 fixes 167 CVEs as Mozilla lists each memory bug alone

Firefox 159 fixes 167 CVEs as Mozilla lists each memory bug alone

27 October 2026: Mozilla has released Firefox 159 with fixes for 167 CVEs and Firefox ESR 153.6 with fixes for 145. Both advisories, MFSA 2026-118 and MFSA 2026-120, rate their overall impact High and contain no critical entry. In Firefox 159 the entries break down into 108 High, 52 Moderate and 7 Low; in ESR 153.6 they are 95 High, 44 Moderate and 6 Low. Neither page mentions exploitation in the wild.

Not yet independently verified. We tallied the severity counts from the entries on each advisory page. The pages give a title and an impact level for each CVE but no description, so we have not been able to say how any single flaw works. We will update this when it can be confirmed, and remove this note.

Anyone who manages desktops should move both channels forward, since the standard and extended support lines are patched on the same day.

One CVE for every memory bug

Both pages open with a change of practice. Mozilla writes: "We no longer roll all internally identified memory safety vulnerabilities into a single CVE". Instead it issues an advisory entry for each individual bug it finds itself.

Each internally found bug can now be tracked on its own, and a CVE total says more about the number of fixes than a grouped entry did. Totals from earlier releases are therefore not directly comparable with these two. Many of the entries are credited to Mozilla itself as the internal reporter.

The High entries worth reading first

The advisory titles show what kinds of bug lead the list. In Firefox 159, CVE-2026-117860 is a same-origin policy bypass in the DOM Navigation component and CVE-2026-117861 is a sandbox escape in the same component. CVE-2026-117862 is a privilege escalation in the Networking component caused by incorrect boundary conditions. Use-after-free entries run through the list, among them CVE-2026-117876 in Layout: Text and Fonts and CVE-2026-117921 in CSS Parsing and Computation.

Sandbox escapes and same-origin bypasses matter most for a browser, because they are the steps that turn a flaw in web content into access to the rest of the machine or to another site's data.

Who found them

Besides Mozilla's own engineers, Firefox 159 credits 20 external reporters or teams, from individual researchers to firms such as Velcore Consulting Inc. The ESR 153.6 list names 19 of them.

Which versions to deploy

• Firefox 159: for the standard release channel.
• Firefox ESR 153.6: for organisations on the extended support line.

Enterprises that pin the ESR line for stability should schedule 153.6 soon, since 95 of its entries are rated High.

Sources

• Mozilla: MFSA 2026-118, Security Vulnerabilities fixed in Firefox 159, 27 October 2026
• Mozilla: MFSA 2026-120, Security Vulnerabilities fixed in Firefox ESR 153.6, 27 October 2026