Firefox 159 fixes high-impact flaws: check ESR branches too

A new browser patch belongs in the business update queue

Mozilla published Security Advisory 2026-118 on October 27, 2026, rated its impact high and identified Firefox 159 as fixed. Organizations using Firefox for email, administrative systems or documents from partners should schedule the update promptly. This report was prepared on October 28; the advisory was published on October 27.

Separate regular Firefox from Firefox ESR, the extended-support branches commonly used by organizations. Mozilla issued separate advisories for ESR 153.6 and ESR 115.44. An ESR version number below 159 does not itself establish that the installation lacks its applicable patch.

Origin boundaries and memory safety are different problems

Mozilla describes CVE-2026-117860 as a same-origin policy bypass in DOM: Navigation. That policy helps separate websites’ data. A failure matters to users working across business systems, but the short advisory does not establish that every signed-in session will be stolen or that a powered-on computer is automatically compromised.

CVE-2026-117904 is a use-after-free in JavaScript garbage collection. CVE-2026-117949 concerns the same class of memory-safety issue in DOM: Core & HTML. These are browser implementation issues, rather than instructions for a company’s content team to repair its website JavaScript instead of updating the browser.

The advisory rates these examples high. The reviewed records do not supply individual CVSS scores or confirm exploitation in the wild. A CVE identifier is not evidence of an active campaign. Details not established by the vendor, including a complete exploit chain or a universal sandbox escape, remain unconfirmed.

Match the fix to the installed branch

Mozilla’s records list Firefox 159, Firefox ESR 153.6, Thunderbird 159 and Thunderbird 153.6 as fixed for CVE-2026-117860 and CVE-2026-117904. CVE-2026-117949 additionally lists Firefox ESR 115.44. This does not mean that ESR 115.44 contains every Firefox 159 feature; it services a separate branch.

Record the installed version, release channel, operating system, installation source and owner. Machines maintained through an operating-system repository may receive distributor packages on a separate schedule. Consult that channel’s maintenance notice rather than overlaying an unrelated package simply to match a version string.

Install, restart and verify the real workflow

Friday Works recommends a pilot group covering actual sign-in systems, signing software and required extensions. Follow existing backup and configuration procedures, obtain updates from Mozilla or the approved management channel, and restart the browser when required. A window left running since before the update may still be using old code.

While rollout is pending, limit untrusted links and files in sensitive workflows and keep account and extension privileges minimal. These measures reduce exposure; they do not replace the fix. Do not disable sandboxing, certificate checks or browser protections to accommodate an old application.

After restarting, inspect About Firefox or the endpoint-management inventory and compare the result with the correct servicing branch. Test normal business tasks and record incomplete devices, reasons and owners. A command sent or a package downloaded is not proof that the active browser session is patched.

Do not confuse a reporting change with a risk trend

Mozilla also changed how it publishes internally identified memory-safety issues: individual bugs now receive separate CVEs rather than being rolled into a shared identifier. Comparing this release’s raw CVE count with earlier releases is therefore not a sound measure of a sudden decline in security. Focus on impact, installed branches and actual deployment.

If suspicious access predates the update, preserve evidence and use the organization’s response process. Patching addresses known vulnerabilities; it does not establish whether a compromise occurred or recover information that may already have been exposed.