Mozilla released Firefox 159 on October 27, 2026. It fixes 167 security bugs. 13 of them could let a bad web page break out of the safety box Firefox keeps web pages in. On November 3, 2026, Mozilla released Firefox 159.0.1, which fixes one more serious bug in how Firefox lays out web pages. Firefox usually updates itself. You can start the update by hand.
- Status
- Patched: update now
- Being attacked?
- Not known[1]
- Severity
- High
- Updated
Mozilla's advisory does not say any of these bugs are being attacked. Severity: Mozilla rates the advisory 'high'. First reported .
Am I affected?
You are at risk if Firefox is older than version 159.0.1. People who use the long-term release (ESR) need ESR 153.6 or ESR 115.44.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Mozilla Firefox | Windows | Firefox before 159.0.1; Firefox ESR before 153.6; ESR 115 before 115.44 | 159.0.1 (ESR: 153.6 or 115.44)[1][2][3][4] |
| Mozilla Firefox | Mac | Firefox before 159.0.1; Firefox ESR before 153.6; ESR 115 before 115.44 | 159.0.1 (ESR: 153.6 or 115.44)[1][2][3][4] |
| Mozilla Firefox | Linux | Firefox before 159.0.1; Firefox ESR before 153.6; ESR 115 before 115.44 | 159.0.1 (ESR: 153.6 or 115.44)[1][2][3][4] |
How to check your version
These checks only look. They do not change anything on your computer.
Mozilla Firefox on Windows
Easy way: Click the three lines at the top right > Help > About Firefox. Firefox checks for updates there.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Mozilla Firefox*' | Select-Object DisplayName,DisplayVersion
Mozilla Firefox on Mac
Easy way: Firefox menu bar: Firefox > About Firefox.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
defaults read "/Applications/Firefox.app/Contents/Info" CFBundleShortVersionString
Mozilla Firefox on Linux
Easy way: Firefox menu > Help > About Firefox.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
firefox --version
How to fix it
- Open Firefox.
- Click the three lines at the top right > Help > About Firefox.
- Wait while it downloads the update.
- Click Restart to update Firefox.
More on each app: Is my Firefox up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/firefox-159-security-fixes.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-117861, CVE-2026-120572
Sources
- MakerMozilla: Security fixes in Firefox 159 (MFSA 2026-118) (Oct 27, 2026)
- MakerMozilla: Security fix in Firefox 159.0.1 (MFSA 2026-123) (Nov 3, 2026)
- MakerMozilla: Security fixes in Firefox ESR 115.44 (MFSA 2026-119) (Oct 27, 2026)
- MakerMozilla: Security fixes in Firefox ESR 153.6 (MFSA 2026-120) (Oct 27, 2026)
- NVDNVD: CVE-2026-117861 (one of the safety-box bugs) (Oct 27, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.