[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

confirmed (vendor: Mozilla MFSA 2026-118, -119, -120, Oct 27); none flagged as exploited

Firefox 159 fixes 167 CVEs, 108 rated high, including 13 sandbox escapes; Firefox ESR 153.6 and 115.44 get most of the same fixes

Mozilla shipped Firefox 159 on Oct 27 with advisory MFSA 2026-118 (overall impact: high). Because Mozilla now issues one CVE per bug, the list is long: 167 CVEs, of which 108 are high, 52 moderate and 7 low. None is rated critical and Mozilla does not say any are exploited.

  • Sandbox escapes: 13, in components such as DOM: Navigation (CVE-2026-117861), Form Manager (CVE-2026-117864), DOM: Networking (CVE-2026-117868), WebRender, Print Preview and accessibility APIs.
  • Other notable bugs: a same-origin policy bypass (CVE-2026-117860), several privilege escalations and about 97 use-after-free bugs.
  • Who found them: Mozilla itself reported most; 34 are credited to OpenAI Codex Security and 7 to Amy Burnett of OpenAI.
  • ESR: Firefox ESR 153.6 (MFSA 2026-120, 145 CVEs) and ESR 115.44 (MFSA 2026-119, 80 CVEs) carry the fixes for those branches.

Update and restart the browser. Managed fleets on ESR should move to 153.6 or 115.44.

Sources: Mozilla MFSA 2026-118: Security vulnerabilities fixed in Firefox 159 · Mozilla MFSA 2026-120: Firefox ESR 153.6 · Mozilla MFSA 2026-119: Firefox ESR 115.44