Firefox 160 fixes 99 flaws, 57 rated high and nine sandbox escapes - update ESR too

What happened

On 10 November 2026 Mozilla released Firefox 160 together with the Extended Support Releases Firefox ESR 153.7 and Firefox ESR 115.45. Security advisory MFSA 2026-125 for Firefox 160 lists 99 vulnerabilities: 57 rated high, 24 moderate and 18 low. This time Mozilla rated none of them critical.

Many of the fixes also land in the ESR builds that organisations deploy for longer support: ESR 153.7 fixes 81 flaws (51 high) and ESR 115.45 fixes 28 (all high). Thunderbird 160 and 153.7 shipped the same day.

Unlike the recent Chrome fix (CVE-2026-125350), Mozilla does not report exploitation for any of these bugs. All three sandbox escapes we cite as examples below were reported internally by Mozilla.

Technical details

Mozilla published only the bug type and component for each flaw. Here is how the 57 high-severity bugs in Firefox 160 break down (our count, based on the advisory titles):

Five of the nine sandbox escapes stem from use-after-free and two from incorrect boundary conditions, so use-after-free is behind 37 of the high-severity bugs in total.

• Sandbox escapes are the most serious class. Firefox runs web content in isolated, low-privilege processes. A bug that breaks that isolation, chained with a second bug in page content, can give an attacker a path to the system. Mozilla fixed nine of them, in text rendering, inter-process communication (IPC), WebGL, Service Workers and the Cache API, among others.
• CVE-2026-124853 (sandbox escape caused by incorrect boundary conditions in Graphics: Text) carries a CVSS 3.1 score of 9.6 from CISA in NVD (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - network attack, no authentication, the victim has to open a page). It is fixed in all three branches.
• Use-after-free (using memory after it has been freed) is the most common type. In a browser it usually means a crafted page can corrupt memory and, under the right conditions, run code in the content process.
• A same-origin policy bypass (CVE-2026-124874, reported by Minseong Kim) could let a page read another site's data that it should not be able to reach.

Mozilla usually opens the Bugzilla entries only after the fix has rolled out widely. We do not publish exploitation details.

Who is affected

• Firefox before 160 (Windows, macOS, Linux).
• Firefox ESR before 153.7 and before 115.45 - typically managed corporate installs.
• Thunderbird before 160 and 153.7.
• Linux distributions ship their own packages - follow their security notices (Snap and Flatpak builds update from the store).

To check the version on Windows (PowerShell, handy for fleet-wide checks through your endpoint management tool):

(Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion

On Linux: firefox --version.

How to tell if you were compromised

Mozilla has not published indicators of compromise and does not mention attacks. Browser exploitation is hard to spot in logs. From our own SOC work:

• Watch your EDR for unusual Firefox child processes (for example firefox.exe spawning cmd.exe, powershell.exe or scripts) - that is one way a sandbox escape could show up.
• Repeated content-process crashes on specific sites (crash reports in about:crashes) are worth a closer look.
• Pull suspicious domains and IPs out of proxy logs quickly with our IOC extractor - it runs entirely in your browser.

What to do

1. Update to Firefox 160, ESR 153.7 or ESR 115.45 and restart the browser - the fix only takes effect after a restart.
2. Admins: check versions on endpoints and make sure policies do not block updates (DisableAppUpdate) without another way to deploy them.
3. Update Thunderbird to 160 or 153.7 as well.
4. If you still run ESR 115 because of an old operating system, plan the move to a supported OS and ESR 153.

Timeline

Updates

• 12 Nov 2026 - first version of this article.