Firefox 159 patches sandbox escape and same-origin policy bypass
Mozilla released Firefox 159 and ESR 153.6 and 115.44 on October 27, 2026. The update patches CVE-2026-117861 (sandbox escape), CVE-2026-117860 (same-origin policy bypass), privilege-escalation bugs and numerous memory-safety flaws. The source reports no active exploitation; update the browser as soon as possible.
What happened
On October 27, 2026, Mozilla released Firefox 159 and the enterprise editions ESR 153.6 and 115.44. The update fixes a sandbox escape, a same-origin policy bypass, privilege-escalation bugs and several memory-safety flaws.
Why it matters
The flaws affect the browser security boundaries that separate web pages from the rest of the system. Firefox is the entry point to email, SaaS and internal systems; a successful attack could compromise data reached through the browser and employee workstations.
What to do
Update every Firefox install to version 159 and every ESR install to 153.6 or 115.44. Check ESR deployments, which often update manually, and confirm auto-update on workstations.
For the technical team
- CVE
- CVE-2026-117861, CVE-2026-117860
- Affected
- Mozilla Firefox, incluindo ESR · Mozilla Firefox, including ESR. The source does not list specific affected versions.
- Exploitation
- No active exploitation or public PoC reported by the source (TheHackersNews).
- Fix
- Update to Firefox 159, Firefox ESR 153.6 or Firefox ESR 115.44.
- Vector
- Firefox browser. Sandbox escape (CVE-2026-117861), same-origin policy bypass (CVE-2026-117860), privilege-escalation bugs and memory-safety flaws affecting browser security boundaries. The source does not detail exploitation conditions.
- More details
- Released on 2026-10-27 per the timeline. Disclosed through Mozilla security advisories reported by TheHackersNews.
Timeline
Mozilla ships Firefox 159 and ESR 153.6 and 115.44 with the fixes.
Sources 1 source
- @TheHackersNews @TheHackersNews
