Mozilla announced Firefox 160 in its MFSA 2026-125 bulletin published on November 10. The bulletin is rated “high” severity and includes fixes for 99 CVEs under a single heading. Thirteen of them are sandbox escape vulnerabilities in the browser.
Why a sandbox escape matters
Browsers run each tab they open in a separate, restricted process. This layer, called the sandbox, prevents a flaw on a website from reaching the operating system. A sandbox escape means a bug that breaks through that wall: if an attacker has a second vulnerability, a malicious page can end up executing code on the device. The NVD gives most of these escape entries a CVSS 3.1 score of 9.6.
Highlights among the fixed entries
The sandbox escapes are spread across different browser components:
- CVE-2026-124853: incorrect bounds condition in the Graphics: Text component
- CVE-2026-124859: incorrect bounds condition in the Storage Cache API component
- CVE-2026-124861: use-after-free in the cubeb component on the audio and video side
- CVE-2026-124864: use-after-free in the DOM: Service Workers component
- CVE-2026-124903: use-after-free in the IPC component
- CVE-2026-124917, CVE-2026-124921, CVE-2026-124923, and CVE-2026-124933: escapes in the Widget: Gtk, WebGPU, Agent, and Console components
The bulletin is not limited to the sandbox. Also among the fixes are three separate site isolation issues (CVE-2026-124913, CVE-2026-124914, CVE-2026-124927), two same-origin policy bypasses (CVE-2026-124931 and CVE-2026-124950), JIT miscompilations in the JavaScript engine (CVE-2026-124939 and CVE-2026-124946), and entries that could cause fake content to be shown in the address bar.
Which versions were fixed
The same fixes were included not only in Firefox 160, but also in Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. So users on the long-term support release are getting the update too.
Firefox updates itself in the background; once the new version has been downloaded, it is enough to close and reopen the browser once. The version number can be checked on the About Firefox screen; if you see a number below 160, the update has not been applied yet. In enterprise deployments, you need to move to ESR 115.45 or ESR 153.7. Thunderbird also needs to be updated to the same version numbers.
One of the entries in the bulletin affects the Media component in Firefox for Android, so you need to be on the latest version on mobile as well. Sandbox escapes do not mean remote code execution on their own; however, when combined with another memory bug in the browser, they can open the door for an attacker to gain privileges on the device. Mozilla published the bulletin with a “high” severity rating and recommends updating.
Source: Mozilla MFSA 2026-125 · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.