{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "firefox-159-security-fixes",
  "url": "https://patchgap.ai/incidents/firefox-159-security-fixes/",
  "path": "/incidents/firefox-159-security-fixes/",
  "json_url": "https://patchgap.ai/incidents/firefox-159-security-fixes.json",
  "title": "Firefox 159 fixes 167 security bugs, and 159.0.1 fixes one more",
  "category": "browsers",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "products": [
   "firefox"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Mozilla rates the advisory 'high'.",
  "exploited_in_wild": "unknown",
  "exploited_note": "Mozilla's advisory does not say any of these bugs are being attacked.",
  "exploited_source_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-10-27",
  "updated_at": "2026-11-03",
  "cves": [
   "CVE-2026-117861",
   "CVE-2026-120572"
  ],
  "summary": "Mozilla released Firefox 159 on October 27, 2026. It fixes 167 security bugs. 13 of them could let a bad web page break out of the safety box Firefox keeps web pages in. On November 3, 2026, Mozilla released Firefox 159.0.1, which fixes one more serious bug in how Firefox lays out web pages. Firefox usually updates itself. You can start the update by hand.",
  "am_i_affected": "You are at risk if Firefox is older than version 159.0.1. People who use the long-term release (ESR) need ESR 153.6 or ESR 115.44.",
  "action": "Update Firefox to 159.0.1 (or ESR 153.6 / 115.44)",
  "affected": [
   {
    "product": "firefox",
    "product_name": "Mozilla Firefox",
    "platform": "windows",
    "affected_versions": "Firefox before 159.0.1; Firefox ESR before 153.6; ESR 115 before 115.44",
    "fixed_version": "159.0.1 (ESR: 153.6 or 115.44)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/"
    ],
    "check": {
     "menu_path": "Click the three lines at the top right > Help > About Firefox. Firefox checks for updates there.",
     "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Mozilla Firefox*' | Select-Object DisplayName,DisplayVersion",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://www.mozilla.org/firefox/new/"
   },
   {
    "product": "firefox",
    "product_name": "Mozilla Firefox",
    "platform": "macos",
    "affected_versions": "Firefox before 159.0.1; Firefox ESR before 153.6; ESR 115 before 115.44",
    "fixed_version": "159.0.1 (ESR: 153.6 or 115.44)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/"
    ],
    "check": {
     "menu_path": "Firefox menu bar: Firefox > About Firefox.",
     "command": "defaults read \"/Applications/Firefox.app/Contents/Info\" CFBundleShortVersionString",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.mozilla.org/firefox/new/"
   },
   {
    "product": "firefox",
    "product_name": "Mozilla Firefox",
    "platform": "linux",
    "affected_versions": "Firefox before 159.0.1; Firefox ESR before 153.6; ESR 115 before 115.44",
    "fixed_version": "159.0.1 (ESR: 153.6 or 115.44)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/",
     "https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/"
    ],
    "check": {
     "menu_path": "Firefox menu > Help > About Firefox.",
     "command": "firefox --version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.mozilla.org/firefox/new/"
   }
  ],
  "fix_steps": [
   "Open Firefox.",
   "Click the three lines at the top right > Help > About Firefox.",
   "Wait while it downloads the update.",
   "Click Restart to update Firefox."
  ],
  "official_patch_links": [
   {
    "label": "Mozilla: download Firefox",
    "url": "https://www.mozilla.org/firefox/new/"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/",
    "title": "Mozilla: Security fixes in Firefox 159 (MFSA 2026-118)",
    "date": "2026-10-27",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/",
    "title": "Mozilla: Security fix in Firefox 159.0.1 (MFSA 2026-123)",
    "date": "2026-11-03",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/",
    "title": "Mozilla: Security fixes in Firefox ESR 115.44 (MFSA 2026-119)",
    "date": "2026-10-27",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/",
    "title": "Mozilla: Security fixes in Firefox ESR 153.6 (MFSA 2026-120)",
    "date": "2026-10-27",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117861",
    "title": "NVD: CVE-2026-117861 (one of the safety-box bugs)",
    "date": "2026-10-27",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}