Mozilla released Firefox 159 on 27 October 2026 with advisory MFSA 2026-118, which is rated high overall and lists 167 CVEs: 108 rated high, 52 moderate and 7 low. Mozilla notes that it no longer rolls internally found memory safety bugs into a single CVE and now issues an advisory for every individual bug, which is why the count is large. High-rated issues include sandbox escapes in the DOM: Navigation component (CVE-2026-117861), the Form Manager component (CVE-2026-117864) and the DOM: Networking component (CVE-2026-117868); privilege escalations in the Networking component (CVE-2026-117862), the Graphics: Canvas2D component (CVE-2026-117866) and WebRTC (CVE-2026-118006, CVE-2026-117892); a same-origin policy bypass in DOM: Navigation (CVE-2026-117860); and JIT miscompilation and use-after-free bugs in the JavaScript engine (for example CVE-2026-117890 and CVE-2026-117891).

Mozilla credits OpenAI Codex Security (kylebot) with 34 of the high-rated bugs and Amy Burnett of OpenAI with 7. The advisory does not say any of the bugs are exploited in the wild.

The same day Mozilla published MFSA 2026-120 for Firefox ESR 153.6, listing 145 CVEs (95 high, 44 moderate, 6 low), and MFSA 2026-119 for Firefox ESR 115.44. Primary: Mozilla security advisories.