# Firefox 159 and Firefox ESR 153.6 and 115.44 fix 167 bugs, including 13 sandbox escapes · pwn.watch

> Mozilla's October 27 Firefox release fixes 167 CVEs in Firefox 159 (108 rated high, 52 moderate, 7 low), 145 in Firefox ESR 153.6 and 80 in Firefox ESR 115.44. Thirteen of the Firefox 159 fixes are sandbox escapes (in components such as WebRender, Canvas WebGL, XPCOM, Print Preview and Form Manager), and the rest include many use-after-free and JIT bugs in the JavaScript engine, layout, DOM and WebRTC. The large count comes partly from a change in how Mozilla publishes advisories: it no longer rolls internally found memory-safety bugs into one CVE and now issues one per bug. Mozilla's advisories don't mention exploitation in the wild. Update Firefox to 159, or ESR to 153.6 or 115.44.

Page: https://pwn.watch/i/firefox-159-esr-153-6-security-release-oct-2026 · generated 2026-10-27T16:41:59.411Z

## Status
- Severity: high · status: live · patch: patched
- Product: Mozilla Firefox and Firefox ESR
- Started: 2026-10-27
- CVEs: CVE-2026-117861, CVE-2026-117864, CVE-2026-117868, CVE-2026-117962, CVE-2026-117971, CVE-2026-118021, CVE-2026-117975, CVE-2026-118022, CVE-2026-117985, CVE-2026-117988, CVE-2026-118023, CVE-2026-117990, CVE-2026-117997
- Affected: Firefox before 159; Firefox ESR before 153.6; Firefox ESR before 115.44
- Fixed in: Firefox 159; Firefox ESR 153.6; Firefox ESR 115.44

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/firefox-159-esr-153-6-security-release-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/firefox-159-esr-153-6-security-release-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/firefox-159-esr-153-6-security-release-oct-2026.json
- This file: https://pwn.watch/i/firefox-159-esr-153-6-security-release-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-27: Mozilla publishes MFSA 2026-118 (Firefox 159, 167 CVEs), MFSA 2026-120 (Firefox ESR 153.6, 145 CVEs) and MFSA 2026-119 (Firefox ESR 115.44, 80 CVEs), and says it now issues a separate CVE for every internally found memory-safety bug. (https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/)

## Fix brief
# Security brief: Firefox 159 and Firefox ESR 153.6 and 115.44 fix 167 bugs, including 13 sandbox escapes

Source: https://pwn.watch/i/firefox-159-esr-153-6-security-release-oct-2026 · status: live · severity: high · updated Oct 27, 2026, 14:35 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Mozilla's October 27 Firefox release fixes 167 CVEs in Firefox 159 (108 rated high, 52 moderate, 7 low), 145 in Firefox ESR 153.6 and 80 in Firefox ESR 115.44. Thirteen of the Firefox 159 fixes are sandbox escapes (in components such as WebRender, Canvas WebGL, XPCOM, Print Preview and Form Manager), and the rest include many use-after-free and JIT bugs in the JavaScript engine, layout, DOM and WebRTC. The large count comes partly from a change in how Mozilla publishes advisories: it no longer rolls internally found memory-safety bugs into one CVE and now issues one per bug. Mozilla's advisories don't mention exploitation in the wild. Update Firefox to 159, or ESR to 153.6 or 115.44.

Severity detail: Mozilla rates the advisories high (no critical ratings); 13 sandbox escapes in Firefox 159; no exploitation in the wild reported

- Product: Mozilla Firefox and Firefox ESR
- CVE / advisory ids: CVE-2026-117861, CVE-2026-117864, CVE-2026-117868, CVE-2026-117962, CVE-2026-117971, CVE-2026-118021, CVE-2026-117975, CVE-2026-118022, CVE-2026-117985, CVE-2026-117988, CVE-2026-118023, CVE-2026-117990, CVE-2026-117997

## Affected versions
- Firefox before 159
- Firefox ESR before 153.6
- Firefox ESR before 115.44

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Firefox 159
- Firefox ESR 153.6
- Firefox ESR 115.44

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Oct 27, 2026: Mozilla publishes MFSA 2026-118 (Firefox 159, 167 CVEs), MFSA 2026-120 (Firefox ESR 153.6, 145 CVEs) and MFSA 2026-119 (Firefox ESR 115.44, 80 CVEs), and says it now issues a separate CVE for every internally found memory-safety bug.

## Advisories
- [MFSA 2026-118: Security Vulnerabilities fixed in Firefox 159](https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/) (Mozilla)
- [MFSA 2026-120: Security Vulnerabilities fixed in Firefox ESR 153.6](https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/) (Mozilla)
- [MFSA 2026-119: Security Vulnerabilities fixed in Firefox ESR 115.44](https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/) (Mozilla)
- [NVD: CVE-2026-117861](https://nvd.nist.gov/vuln/detail/CVE-2026-117861) (NVD)

---
Machine-readable: https://pwn.watch/i/firefox-159-esr-153-6-security-release-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.