Firefox 159 and ESR Updates Fix Sandbox and Memory Safety Issues
Mozilla’s 27 October security updates cover Firefox 159 and two Extended Support Release branches, with fixes for sandbox escapes, privilege escalation, memory handling and other weaknesses. The practical task is to update the branch each device actually runs. A regular desktop installation, an organisation’s ESR deployment and an older machine retained on Firefox 115 ESR have different version targets.
As checked on 31 October, Mozilla’s current version feed lists Firefox 159.0, Firefox ESR 153.6.0esr and Firefox ESR 115.44.0esr. The regular release notes and the release notes for ESR 153.6.0 and ESR 115.44.0 date those releases to 27 October. These are the current releases checked for this report, rather than a new release announced today.
Three branches, overlapping fixes
A count of the individual identifiers and impact labels in Mozilla’s complete advisories gives the following breakdown. All three advisories carry an overall High impact label; none of their individual entries is labelled Critical.
| Fixed branch | Entries | Mozilla impact labels |
|---|---|---|
| Firefox 159 | 167 | 108 High, 52 Moderate, 7 Low |
| Firefox ESR 153.6 | 145 | 95 High, 44 Moderate, 6 Low |
| Firefox ESR 115.44 | 80 | 72 High, 7 Moderate, 1 Low |
These are counts within each advisory. All 145 identifiers in the ESR 153.6 list also appear in the regular Firefox 159 list. The older ESR 115.44 list shares 76 identifiers with each of those lists and includes four identifiers absent from the regular list. Adding the three totals would therefore count many issues more than once. An identifier’s absence from another advisory also does not, by itself, establish that the other branch is unaffected.
Mozilla has also changed the granularity of its reporting: internally discovered memory safety bugs that previously could have been grouped under one identifier now receive individual entries. That makes a raw comparison with older release totals misleading. A longer list alone cannot establish that the browser has become proportionately more dangerous or that more attacks have occurred. Mozilla explains the change at the top of each linked advisory.
What the security labels establish
The regular advisory contains 13 entries whose titles describe a sandbox escape. Three are rated High and ten Moderate. Those titles identify the security boundary involved; they do not demonstrate that all 13 can be combined, that a complete attack chain has been published, or that any particular organisation has been compromised.
The examples below show the range of the fixes. Ratings and descriptions come from Mozilla. The branch column records membership of the three advisories examined here, without making an unaffected claim for an unlisted branch.
| Identifier | Mozilla impact | Reported issue | Listed fixed branches |
|---|---|---|---|
| CVE-2026-117861 | High | DOM navigation: sandbox escape | 159; ESR 153.6 |
| CVE-2026-117862 | High | Networking: boundary error allowing privilege escalation | 159; ESR 153.6; ESR 115.44 |
| CVE-2026-117865 | High | JavaScript garbage collection: use after free | 159; ESR 153.6 |
| CVE-2026-118018 | Moderate | Android Downloads: spoofing | 159 |
| CVE-2026-118023 | Moderate | WebRender graphics: use after free associated with a sandbox escape | 159 |
| CVE-2026-117999 | Low | Interprocess communication: race condition | 159; ESR 153.6 |
The Android Downloads entry is another reason to read the scope carefully: the 167-entry regular advisory is not a list of 167 desktop-only flaws. Mozilla’s separate Android 159 release notes, also dated 27 October, link to that same security advisory. The presence of an Android-specific issue does not make every other entry applicable to every mobile device.
For defenders, the labels justify checking patch coverage across the installed fleet. They do not provide enough detail to reconstruct exploit prerequisites or claim a proven route from a malicious page to full control of a device. This report makes no claim that these fixes respond to confirmed exploitation in the wild.
Choose an update the device can run
For regular desktop installations, check against Firefox 159.0. Organisations using the current ESR branch should check against 153.6.0esr. Mozilla’s system requirements for 159.0 and ESR 153.6.0 specify Windows 10 or later and macOS 10.15 or later. Linux deployments need to meet the listed library requirements or their distributor’s package requirements.
Architecture matters too. Mozilla’s 32-bit Linux support notice says its regular 32-bit releases stop at Firefox 144 and its ESR releases at 140. Do not assume that a 32-bit Linux machine can install 159 or ESR 153. A distribution may provide a different package; verify its current security maintenance and plan a supported migration if needed.
Older systems have a separate route. Mozilla identifies Firefox 115 ESR as the last compatible branch for Windows 7, 8 and 8.1 and macOS 10.12, 10.13 and 10.14. Its current support pages extend updates for those systems until March 2027, when support will be reassessed. The current 115-branch target is 115.44.0esr. That extension buys time for migration; a browser update does not repair an unsupported operating system. Plan the operating system or hardware move alongside browser maintenance.
On Android, use the Android release and its own delivery channel. Firefox for Android 159.0 requires Android 8.0 or newer. Mozilla’s Android update guide directs users to Google Play, or an appropriate regional app marketplace where Google Play is unavailable. The desktop ESR numbers are not an Android update route. Check the installed Android app version after the update.
Verify the running browser after the update
For a desktop copy installed directly from Mozilla, open Help, then About Firefox; on macOS, use Firefox, then About Firefox. Let the update finish and restart when prompted. Mozilla’s desktop update instructions warn that a download can still be continuing in the background and that a restart applies the update. Reopen About Firefox afterwards and record the version actually running.
Use the installation’s normal maintenance route. Microsoft Store copies update through the Store, while distribution-packaged Linux copies depend on the distributor’s repository. Managed installations should follow their organisation’s deployment policy. An upstream release announcement does not prove that an update is available to a particular device. For distribution packages, compare the installed package with the distributor’s security notice and fixed package version.
A useful completion record contains the device’s operating system, browser channel, installed version after relaunch and any remaining update failure. Keep incompatible or stalled devices visible in the remediation work, with an owner and a migration plan. A downloaded update or an approved deployment job is only an intermediate step; the running browser is the check that matters to the person using it.
Source reporting: Mozilla’s complete security advisories for Firefox 159, ESR 153.6 and ESR 115.44, with release and support documentation linked above. Counts were checked against all entries in each advisory. Mozilla credits individual mozilla.org contributors and publishes its document text under CC BY-SA 3.0 or later; this report independently summarises the technical facts and adds deployment advice.
