Summary
- Firefox 159 fixes multiple high-impact browser security issues across core components.
- Mozilla now assigns separate advisories to more individual memory safety findings.
- The release is distinct from Firefox 158 patches covered earlier in October.
Mozilla has released Firefox 159 with security fixes addressing sandbox escapes, same-origin policy bypasses, privilege escalation and a range of memory safety weaknesses. Its 27 October advisory lists numerous separate CVE identifiers, reflecting a change in how Mozilla discloses internally identified memory-related bugs.
Among the high-impact entries are CVE-2026-117860, involving the handling of origin boundaries in navigation, CVE-2026-117861, a sandbox escape in the same general component, and CVE-2026-117862, a privilege escalation issue affecting networking. Other entries address JavaScript memory management, layout, graphics, WebRTC, browser storage and XML processing.
Mozilla has also released related updates across supported enterprise and extended-support branches. Administrators must match the relevant advisory to the actual version and update channel deployed, because desktop Firefox, extended-support releases and other Mozilla products do not necessarily share the same patch numbering.
Browser boundaries and what they protect
Modern web browsers divide work among components with different privileges. Content from websites should not ordinarily be able to cross into more sensitive operating-system functions simply because a malicious page is displayed. Sandbox escapes and privilege escalation vulnerabilities can weaken those boundaries, especially where several vulnerabilities could be combined in one attack chain.
A same-origin policy bypass concerns another important restriction: scripts from one website should not have unrestricted access to sensitive content belonging to a separate site. The impact of a particular bypass depends on the component and user interaction involved. An entry in an advisory is not by itself proof that cross-site data theft occurred against real users.
Memory safety weaknesses can create risks of crashes, information disclosure or code execution under particular conditions. However, exploitability varies greatly between bugs, and the presence of dozens of CVEs in an advisory does not mean every one offers a practical route to compromise. Mozilla’s published impact classifications and affected components are a better starting point than counting the entries alone.
The company says its reporting practice has changed: instead of grouping internally discovered memory safety issues into one aggregate CVE, it is assigning advisories to individual bugs. The resulting increase in the number of listed CVEs should therefore not be read uncritically as a comparable increase in underlying vulnerability incidence against previous Firefox releases.
The enterprise patching problem
Browsers are a significant part of an organisation’s security boundary because they process content obtained from a wide range of external sites, identity providers, business services and document links. A browser compromise can also create opportunities to reach locally accessible services or tokens, depending on the privileges obtained and other controls in place.
Endpoint fleets rarely consist of one homogeneous browser installation. Some users receive automatic releases, while managed devices follow enterprise policies or an extended-support branch. Shared workstations, restricted networks and virtual desktop images can follow separate update paths. That variety makes it possible for published fixes to exist before every endpoint has received them.
Organisations assessing the new release need to distinguish fixes that affect the browser engine generally from those tied to optional features or particular platforms. For example, a flaw in a media or rendering component may have different conditions from one affecting navigation and origin boundaries. Those details influence exposure and testing without diminishing the value of prompt security maintenance.
Mozilla’s advisory attributes individual findings to external researchers, internal teams and automated security work. The disclosures therefore cover a mixture of discovery methods, not one single attack campaign or coordinated exploitation event.
No comprehensive evidence of active exploitation is established merely by the advisory’s list of corrected bugs. Claims that a listed Firefox 159 CVE was used in the wild would require separate confirmation from Mozilla, a response authority or reliable researchers.
Mozilla’s 27 October Firefox 159 advisory lists new vulnerabilities affecting origin boundaries, sandboxing and memory safety. Because it now assigns separate CVEs to individual internally discovered memory defects, raw CVE totals cannot be compared directly with earlier aggregated Firefox advisories.
