Mozilla Firefox 159 and ESR Updates Fix 171 Security CVEs

Quick Answer

Mozilla advisories MFSA 2026-118 through MFSA 2026-120 fix 171 unique CVEs in Firefox 159 and ESR 115.44/153.6. Inventory browser branches, deploy the matching supported release, validate policy and critical applications, and retain evidence.

Last verified: 2026-10-27 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	Mozilla Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6
Advisory	MFSA 2026-118 / MFSA 2026-119 / MFSA 2026-120
CVEs	CVE-2026-100801, CVE-2026-109705, CVE-2026-109707, CVE-2026-109708, CVE-2026-117860, CVE-2026-117861, CVE-2026-117862, CVE-2026-117863, CVE-2026-117864, CVE-2026-117865, CVE-2026-117866, CVE-2026-117867, CVE-2026-117868, CVE-2026-117869, CVE-2026-117870, CVE-2026-117871, CVE-2026-117872, CVE-2026-117873, CVE-2026-117874, CVE-2026-117875, CVE-2026-117876, CVE-2026-117877, CVE-2026-117878, CVE-2026-117879, CVE-2026-117880, CVE-2026-117881, CVE-2026-117882, CVE-2026-117883, CVE-2026-117884, CVE-2026-117885, CVE-2026-117886, CVE-2026-117887, CVE-2026-117888, CVE-2026-117889, CVE-2026-117890, CVE-2026-117891, CVE-2026-117892, CVE-2026-117893, CVE-2026-117894, CVE-2026-117895, CVE-2026-117896, CVE-2026-117897, CVE-2026-117898, CVE-2026-117899, CVE-2026-117900, CVE-2026-117901, CVE-2026-117902, CVE-2026-117903, CVE-2026-117904, CVE-2026-117905, CVE-2026-117906, CVE-2026-117907, CVE-2026-117908, CVE-2026-117909, CVE-2026-117910, CVE-2026-117911, CVE-2026-117912, CVE-2026-117913, CVE-2026-117914, CVE-2026-117915, CVE-2026-117916, CVE-2026-117917, CVE-2026-117918, CVE-2026-117919, CVE-2026-117920, CVE-2026-117921, CVE-2026-117922, CVE-2026-117923, CVE-2026-117924, CVE-2026-117925, CVE-2026-117926, CVE-2026-117927, CVE-2026-117928, CVE-2026-117929, CVE-2026-117930, CVE-2026-117931, CVE-2026-117932, CVE-2026-117933, CVE-2026-117934, CVE-2026-117935, CVE-2026-117936, CVE-2026-117937, CVE-2026-117938, CVE-2026-117939, CVE-2026-117940, CVE-2026-117941, CVE-2026-117942, CVE-2026-117943, CVE-2026-117944, CVE-2026-117945, CVE-2026-117946, CVE-2026-117947, CVE-2026-117948, CVE-2026-117949, CVE-2026-117950, CVE-2026-117951, CVE-2026-117952, CVE-2026-117953, CVE-2026-117954, CVE-2026-117955, CVE-2026-117956, CVE-2026-117957, CVE-2026-117958, CVE-2026-117959, CVE-2026-117960, CVE-2026-117961, CVE-2026-117962, CVE-2026-117963, CVE-2026-117964, CVE-2026-117965, CVE-2026-117966, CVE-2026-117967, CVE-2026-117968, CVE-2026-117969, CVE-2026-117970, CVE-2026-117971, CVE-2026-117972, CVE-2026-117973, CVE-2026-117974, CVE-2026-117975, CVE-2026-117976, CVE-2026-117977, CVE-2026-117978, CVE-2026-117979, CVE-2026-117980, CVE-2026-117981, CVE-2026-117982, CVE-2026-117983, CVE-2026-117984, CVE-2026-117985, CVE-2026-117986, CVE-2026-117987, CVE-2026-117988, CVE-2026-117989, CVE-2026-117990, CVE-2026-117991, CVE-2026-117992, CVE-2026-117993, CVE-2026-117994, CVE-2026-117995, CVE-2026-117996, CVE-2026-117997, CVE-2026-117998, CVE-2026-117999, CVE-2026-118000, CVE-2026-118002, CVE-2026-118003, CVE-2026-118004, CVE-2026-118005, CVE-2026-118006, CVE-2026-118007, CVE-2026-118008, CVE-2026-118009, CVE-2026-118010, CVE-2026-118011, CVE-2026-118012, CVE-2026-118013, CVE-2026-118014, CVE-2026-118015, CVE-2026-118016, CVE-2026-118017, CVE-2026-118018, CVE-2026-118019, CVE-2026-118020, CVE-2026-118021, CVE-2026-118022, CVE-2026-118023, CVE-2026-118024, CVE-2026-118025, CVE-2026-118026, CVE-2026-118027
Authoritative release date	2026-10-27 00:00:00 UTC
Authority revision date	2026-10-27 00:00:00 UTC
Affected versions	Firefox before 159, Firefox ESR 115 before 115.44, and Firefox ESR 153 before 153.6; CVE coverage differs by branch and must be matched to the individual Mozilla advisory.
Fixed version	Firefox 159; Firefox ESR 115.44; Firefox ESR 153.6
CVSS base score	Not provided by the authority
CVSS severity	Low to High
Exploitation status	Mozilla does not state in these advisories that the listed vulnerabilities are being maliciously exploited.; no exploitation claim is inferred.

What Changed

Mozilla published three branch-specific advisories covering 171 unique CVEs, including high-impact sandbox, memory-safety, same-origin, privilege, graphics, networking, and WebRTC issues.

What To Validate Now

1. Inventory. Inventory managed Firefox and ESR installations, exact branches and versions, update policies, extensions, owners, exceptions, and offline systems.
2. Establish applicability. Match every device to its branch-specific Mozilla advisory; do not apply the Firefox 159 CVE list or build number to an ESR branch.
3. Remediate. Deploy Firefox 159, Firefox ESR 115.44, or Firefox ESR 153.6 through supported management controls, as applicable.
4. Validate. Confirm the active version after restart, verify enterprise policy and extensions, test authentication and critical web applications, monitor crashes, and retain fleet and change evidence.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Mozilla provides impact ratings but no CVSS base scores in these advisories. The CVE sets overlap substantially but are not identical, so branch matching remains essential.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• MFSA 2026-118
• MFSA 2026-119
• MFSA 2026-120

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.