On October 27, 2026, Mozilla released Firefox 159 and Firefox ESR 153.6 for enterprise users. According to the company’s security advisory, 167 security vulnerabilities were fixed in the desktop browser. 109 of the vulnerabilities were marked as high severity.
The ESR 153.6 advisory lists 145 CVE records, 96 of which are high severity. The same advisories also include records for Firefox for Android.
Which vulnerabilities were fixed?
The list is dominated by bugs that directly affect the browser’s defense layers. A bug in the DOM: Navigation component that bypassed the same-origin policy (CVE-2026-117860) and a second vulnerability in the same component that led to a sandbox escape (CVE-2026-117861) were fixed. A use-after-free bug in the JavaScript garbage collector (CVE-2026-117865), along with memory corruption (CVE-2026-118005) and privilege escalation stemming from that bug (CVE-2026-118006) in the WebRTC signaling component, were also fixed.
In the graphics layer, privilege escalation in the Canvas2D component (CVE-2026-117866), use-after-free bugs in the Layout and XML components, and race condition bugs on the network side were also fixed. A spoofing issue in the Downloads component in Firefox for Android (CVE-2026-118018) was also resolved.
Why is the number so high?
In the advisory, Mozilla said it had changed its publication policy. The company no longer groups memory safety bugs found by its own team under a single CVE; it now opens a separate record for each bug. So the number 167 does not mean the browser received 167 times as many bugs as the previous version; part of the increase comes from the reporting method.
Still, the list is weighted toward memory corruption and sandbox escape bugs. When combined with a scenario that lures a user to a malicious page, these vulnerabilities can make it possible to break out of the browser’s protection layers. Mozilla did not share any information in the advisory indicating that these vulnerabilities are being actively exploited.
How to update?
On the desktop, just open Help → About Firefox from the menu. The browser finds and downloads the new version and asks you to restart. If automatic updates are enabled, the files are installed in the background, but the old version keeps running until the browser is restarted. Enterprise ESR users should move to version 153.6. On Android, the update comes through Google Play.
To check the version, type about:support into the address bar and look at the Version line.
Source: Mozilla Security Advisory · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.