---
title: Firefox 159 fixes 167 CVEs, 108 rated high, including 13 sandbox escapes; Firefox ESR 153.6 and 115.44 get most of the same fixes | ctxsec
url: https://ctxsec.com/items/firefox-159-esr-153-6-115-44-mfsa2026-118
description: ""
status: "confirmed (vendor: Mozilla MFSA 2026-118, -119, -120, Oct 27); none flagged as exploited"
published: 2026-10-27
---

> 

[← Cybersecurity News](/news) · [markdown](/items/firefox-159-esr-153-6-115-44-mfsa2026-118.md)

confirmed (vendor: Mozilla MFSA 2026-118, -119, -120, Oct 27); none flagged as exploited

2026-10-27

### Firefox 159 fixes 167 CVEs, 108 rated high, including 13 sandbox escapes; Firefox ESR 153.6 and 115.44 get most of the same fixes

Mozilla shipped **Firefox 159** on Oct 27 with advisory MFSA 2026-118 (overall impact: high). Because Mozilla now issues one CVE per bug, the list is long: **167 CVEs**, of which 108 are high, 52 moderate and 7 low. None is rated critical and Mozilla does not say any are exploited.

- **Sandbox escapes:** 13, in components such as DOM: Navigation (CVE-2026-117861), Form Manager (CVE-2026-117864), DOM: Networking (CVE-2026-117868), WebRender, Print Preview and accessibility APIs.
- **Other notable bugs:** a same-origin policy bypass (CVE-2026-117860), several privilege escalations and about 97 use-after-free bugs.
- **Who found them:** Mozilla itself reported most; 34 are credited to **OpenAI Codex Security** and 7 to Amy Burnett of OpenAI.
- **ESR:** Firefox ESR 153.6 (MFSA 2026-120, 145 CVEs) and ESR 115.44 (MFSA 2026-119, 80 CVEs) carry the fixes for those branches.

Update and restart the browser. Managed fleets on ESR should move to 153.6 or 115.44.

Sources: [Mozilla MFSA 2026-118: Security vulnerabilities fixed in Firefox 159](https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/) · [Mozilla MFSA 2026-120: Firefox ESR 153.6](https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/) · [Mozilla MFSA 2026-119: Firefox ESR 115.44](https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/)