Mozilla Firefox 160 and ESR Updates Fix Browser Security Vulnerabilities

Quick Answer

Deploy Firefox 160, ESR 153.7 or ESR 115.45 for the configured branch, then relaunch every browser process. Verify versions, test required extensions and web applications, and retain deployment evidence.

Last verified: 2026-11-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	Firefox desktop and Firefox ESR
Advisory	MFSA-2026-125 / MFSA-2026-126 / MFSA-2026-127
CVEs	CVE-2026-109736, CVE-2026-118007, CVE-2026-118019, CVE-2026-118021, CVE-2026-118024, CVE-2026-124852, CVE-2026-124853, CVE-2026-124854, CVE-2026-124855, CVE-2026-124856, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124862, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124866, CVE-2026-124867, CVE-2026-124868, CVE-2026-124869, CVE-2026-124870, CVE-2026-124871, CVE-2026-124872, CVE-2026-124873, CVE-2026-124874, CVE-2026-124875, CVE-2026-124876, CVE-2026-124877, CVE-2026-124878, CVE-2026-124879, CVE-2026-124880, CVE-2026-124881, CVE-2026-124882, CVE-2026-124883, CVE-2026-124884, CVE-2026-124885, CVE-2026-124886, CVE-2026-124887, CVE-2026-124888, CVE-2026-124889, CVE-2026-124890, CVE-2026-124891, CVE-2026-124892, CVE-2026-124893, CVE-2026-124894, CVE-2026-124895, CVE-2026-124896, CVE-2026-124897, CVE-2026-124898, CVE-2026-124899, CVE-2026-124900, CVE-2026-124901, CVE-2026-124902, CVE-2026-124903, CVE-2026-124904, CVE-2026-124905, CVE-2026-124906, CVE-2026-124907, CVE-2026-124908, CVE-2026-124909, CVE-2026-124910, CVE-2026-124911, CVE-2026-124912, CVE-2026-124913, CVE-2026-124914, CVE-2026-124915, CVE-2026-124917, CVE-2026-124918, CVE-2026-124919, CVE-2026-124920, CVE-2026-124921, CVE-2026-124922, CVE-2026-124923, CVE-2026-124924, CVE-2026-124925, CVE-2026-124926, CVE-2026-124927, CVE-2026-124928, CVE-2026-124929, CVE-2026-124930, CVE-2026-124931, CVE-2026-124932, CVE-2026-124933, CVE-2026-124934, CVE-2026-124935, CVE-2026-124936, CVE-2026-124937, CVE-2026-124938, CVE-2026-124939, CVE-2026-124940, CVE-2026-124941, CVE-2026-124942, CVE-2026-124943, CVE-2026-124944, CVE-2026-124945, CVE-2026-124946, CVE-2026-124947, CVE-2026-124948, CVE-2026-124949, CVE-2026-124950, CVE-2026-124951, CVE-2026-124952
Authoritative release date	November 10, 2026; Mozilla supplies a calendar date without a release time.
Authority revision date	No separate later revision stated.
Affected versions	Firefox and ESR installations requiring the fixes in MFSA-2026-125, MFSA-2026-126 and MFSA-2026-127. Mozilla does not state a universal lower affected-version boundary. Each branch has a different CVE set, shown below.
Fixed version	Firefox 160; Firefox ESR 153.7; Firefox ESR 115.45
CVSS base score	Not provided by the authority
CVSS severity	High (Mozilla impact; CVSS severity not provided)
Exploitation status	Mozilla does not state malicious exploitation in these advisories.; no exploitation claim is inferred.

What Changed

Mozilla released three browser security advisories covering 105 distinct CVEs, including memory-safety, sandbox-boundary and privilege-escalation issues. Firefox 160 lists 99 CVEs, ESR 153.7 lists 81 and ESR 115.45 lists 28; these are overlapping branch-specific sets.

What To Validate Now

1. Inventory. Record desktop Firefox branch, installed and running versions, enterprise policy, extensions and application owners.
2. Establish applicability. Apply the CVE set for the configured branch. These advisories do not establish exposure or remediation of Firefox for iOS, Thunderbird or another browser.
3. Remediate. Use the supported application or enterprise distribution channel for the matching fixed version, then relaunch Firefox. Preserve enterprise channel policy.
4. Validate. Confirm running versions after restart, test managed sign-in, extensions and critical applications, and retain rollout failures, exceptions and relevant browser telemetry.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Do not change ESR branches merely to obtain a larger version number. Mozilla provides impact labels and limited technical detail, but no CVSS base scores; do not infer exploitation from the High impact label.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• MFSA-2026-125
• MFSA-2026-126
• MFSA-2026-127

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.

• Additional first-party advisory
• Additional first-party advisory

Branch-Specific CVE Scope

• Mozilla branch advisory: CVE-2026-118007, CVE-2026-118019, CVE-2026-118021, CVE-2026-118024, CVE-2026-124853, CVE-2026-124854, CVE-2026-124855, CVE-2026-124856, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124862, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124866, CVE-2026-124868, CVE-2026-124869, CVE-2026-124870, CVE-2026-124872, CVE-2026-124873, CVE-2026-124874, CVE-2026-124875, CVE-2026-124876, CVE-2026-124877, CVE-2026-124879, CVE-2026-124880, CVE-2026-124881, CVE-2026-124882, CVE-2026-124883, CVE-2026-124884, CVE-2026-124885, CVE-2026-124886, CVE-2026-124887, CVE-2026-124888, CVE-2026-124889, CVE-2026-124890, CVE-2026-124891, CVE-2026-124892, CVE-2026-124893, CVE-2026-124894, CVE-2026-124895, CVE-2026-124896, CVE-2026-124897, CVE-2026-124898, CVE-2026-124899, CVE-2026-124901, CVE-2026-124902, CVE-2026-124903, CVE-2026-124905, CVE-2026-124906, CVE-2026-124907, CVE-2026-124909, CVE-2026-124910, CVE-2026-124912, CVE-2026-124913, CVE-2026-124914, CVE-2026-124915, CVE-2026-124917, CVE-2026-124918, CVE-2026-124919, CVE-2026-124922, CVE-2026-124924, CVE-2026-124926, CVE-2026-124927, CVE-2026-124929, CVE-2026-124930, CVE-2026-124931, CVE-2026-124932, CVE-2026-124933, CVE-2026-124934, CVE-2026-124935, CVE-2026-124938, CVE-2026-124939, CVE-2026-124940, CVE-2026-124941, CVE-2026-124942, CVE-2026-124948, CVE-2026-124951
• Mozilla branch advisory: CVE-2026-109736, CVE-2026-124853, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124872, CVE-2026-124874, CVE-2026-124875, CVE-2026-124876, CVE-2026-124877, CVE-2026-124880, CVE-2026-124881, CVE-2026-124882, CVE-2026-124885, CVE-2026-124890, CVE-2026-124895, CVE-2026-124898, CVE-2026-124899, CVE-2026-124901, CVE-2026-124902, CVE-2026-124903, CVE-2026-124905, CVE-2026-124952
• Mozilla branch advisory: CVE-2026-124852, CVE-2026-124853, CVE-2026-124854, CVE-2026-124855, CVE-2026-124856, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124862, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124866, CVE-2026-124867, CVE-2026-124868, CVE-2026-124869, CVE-2026-124870, CVE-2026-124871, CVE-2026-124872, CVE-2026-124873, CVE-2026-124874, CVE-2026-124875, CVE-2026-124876, CVE-2026-124877, CVE-2026-124878, CVE-2026-124879, CVE-2026-124880, CVE-2026-124881, CVE-2026-124882, CVE-2026-124883, CVE-2026-124884, CVE-2026-124885, CVE-2026-124886, CVE-2026-124887, CVE-2026-124888, CVE-2026-124889, CVE-2026-124890, CVE-2026-124891, CVE-2026-124892, CVE-2026-124893, CVE-2026-124894, CVE-2026-124895, CVE-2026-124896, CVE-2026-124897, CVE-2026-124898, CVE-2026-124899, CVE-2026-124900, CVE-2026-124901, CVE-2026-124902, CVE-2026-124903, CVE-2026-124904, CVE-2026-124905, CVE-2026-124906, CVE-2026-124907, CVE-2026-124908, CVE-2026-124909, CVE-2026-124910, CVE-2026-124911, CVE-2026-124912, CVE-2026-124913, CVE-2026-124914, CVE-2026-124915, CVE-2026-124917, CVE-2026-124918, CVE-2026-124919, CVE-2026-124920, CVE-2026-124921, CVE-2026-124922, CVE-2026-124923, CVE-2026-124924, CVE-2026-124925, CVE-2026-124926, CVE-2026-124927, CVE-2026-124928, CVE-2026-124929, CVE-2026-124930, CVE-2026-124931, CVE-2026-124932, CVE-2026-124933, CVE-2026-124934, CVE-2026-124935, CVE-2026-124936, CVE-2026-124937, CVE-2026-124938, CVE-2026-124939, CVE-2026-124940, CVE-2026-124941, CVE-2026-124942, CVE-2026-124943, CVE-2026-124944, CVE-2026-124945, CVE-2026-124946, CVE-2026-124947, CVE-2026-124948, CVE-2026-124949, CVE-2026-124950, CVE-2026-124951