Mozilla releases Firefox 159 with a large batch of security fixes

Mozilla has published a security advisory for Firefox 159, announced on 27 October 2026. The advisory lists a long set of vulnerabilities fixed in this version and gives the release an overall impact rating of High.

Examples from the advisory’s list, each rated High, include:

• sandbox escapes in the DOM navigation and Form Manager components (a sandbox limits what a web page can do on your device; an escape gets around that limit)
• a same-origin policy bypass in the DOM navigation component
• use-after-free memory flaws in the JavaScript, graphics and layout components
• privilege escalation issues in the networking and graphics components

The advisory also notes a change in how Mozilla publishes these fixes: it no longer rolls all internally identified memory safety vulnerabilities into a single CVE, which is one reason the list is longer than usual.

The advisory doesn’t say that any of these flaws have been exploited.

Who it affects

People using Firefox on a computer. Mozilla lists Firefox as the affected product, fixed in Firefox 159.

What Mozilla’s advisory says

The advisory identifies Firefox 159 as the version containing the fixes. Our earlier item on Firefox 158.0.1 describes Mozilla’s steps for checking for an update manually.

Our browser privacy and security guide explains how browser updates and safety settings work.