Firefox 159.0.1 patches high-risk vulnerability

On November 3, 2026, Mozilla released Firefox 159.0.1. The most important thing about the release is that it fixes a single security vulnerability. According to the company’s security bulletin MFSA2026-123, the vulnerability coded CVE-2026-120572 has a “high” impact rating and is fixed only in Firefox 159.0.1.

The vulnerability stems from faulty boundary conditions in the “Layout: Block and Inline” component of the browser’s page layout engine. Mozilla classifies it under the CWE-119 class, meaning a problem related to improper checking of buffer boundaries in memory. Mozilla’s own security team found the vulnerability; the bulletin does not include an acknowledgment note for an external researcher.

NVD score is 8.8, but user interaction is required

The CVSS 3.1 score added to the NVD record by CISA’s advisory team is 8.8. The vector indicates that the attack can be carried out over the network with low complexity, but requires the user to take an action. On the impact side, confidentiality, integrity, and availability are marked “high”.

The SSVC assessment in the same record shows no sign that the vulnerability is currently being actively exploited; it is also marked “not appropriate” for a self-propagating attack. So there is no reason to panic, but keeping the browser up to date remains the simplest precaution. In recent weeks, browser vulnerabilities have been among the entry points attackers try most often.

What else did 159.0.1 fix besides security

According to the release notes, the same update also fixes a few annoying bugs. One of them is being unable to sign in on sites that share passkeys, such as Facebook and Instagram. Crashes on Windows when certain antivirus software is installed, and WebGL being disabled after those crashes, have also been fixed.

On the Linux side, red and blue colors being swapped on sites that use WebGL also affected background effects in video calls; this bug has also been fixed. In some themes, the tab attention indicator being hard to see, a command prompt window briefly opening after an update on Windows, and settings descriptions breaking in the middle of a word on some sites are other issues fixed in the same release.

How to update

Firefox usually updates itself in the background; the version may already be newer after you close and reopen the browser. To check, go to Help and then About Firefox from the menu in the top-right corner. If the window that opens does not show 159.0.1 or a later version, click the update button and restart the browser.

In organizations that manage updates centrally, you need to confirm that the deployment policy covers this version. The Mozilla bulletin lists only desktop Firefox 159.0.1; there is no separate record for the long-term support ESR line in this bulletin.

Source: Mozilla Security Bulletin MFSA2026-123 · NVD