Firefox 159 and Firefox ESR 153.6 and 115.44 fix 167 bugs, including 13 sandbox escapes

Mozilla Firefox and Firefox ESR

Mozilla's October 27 Firefox release fixes 167 CVEs in Firefox 159 (108 rated high, 52 moderate, 7 low), 145 in Firefox ESR 153.6 and 80 in Firefox ESR 115.44. Thirteen of the Firefox 159 fixes are sandbox escapes (in components such as WebRender, Canvas WebGL, XPCOM, Print Preview and Form Manager), and the rest include many use-after-free and JIT bugs in the JavaScript engine, layout, DOM and WebRTC. The large count comes partly from a change in how Mozilla publishes advisories: it no longer rolls internally found memory-safety bugs into one CVE and now issues one per bug. Mozilla's advisories don't mention exploitation in the wild. Update Firefox to 159, or ESR to 153.6 or 115.44.

Why this severity: Mozilla rates the advisories high (no critical ratings); 13 sandbox escapes in Firefox 159; no exploitation in the wild reported

Started: Oct 27, 2026
CVEs: CVE-2026-117861 CVE-2026-117864 CVE-2026-117868 CVE-2026-117962 CVE-2026-117971 CVE-2026-118021 CVE-2026-117975 CVE-2026-118022 CVE-2026-117985 CVE-2026-117988 CVE-2026-118023 CVE-2026-117990 CVE-2026-117997

Follow this incident

Updated Oct 27, 2026, 14:35 UTCDiscuss on X ↗

Affected

Firefox before 159
Firefox ESR before 153.6
Firefox ESR before 115.44

Fixed in

Firefox 159
Firefox ESR 153.6
Firefox ESR 115.44

Timeline1

Oct 27, 2026
Mozilla publishes MFSA 2026-118 (Firefox 159, 167 CVEs), MFSA 2026-120 (Firefox ESR 153.6, 145 CVEs) and MFSA 2026-119 (Firefox ESR 115.44, 80 CVEs), and says it now issues a separate CVE for every internally found memory-safety bug.

Advisories4

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified

Become a sponsor