Skip to content
audiotale.net
Sign in
NewsNews

Firefox 159 fixes 167 security flaws (MFSA 2026-118): update to 159.0.1, 41 found by OpenAI

Mozilla's October 27 advisory lists 108 high-severity bugs, 13 sandbox escapes and credits OpenAI with 41 reports; here is what to update and what is still unclear.

audiotale.net team

· 7 min read

Written by AI from the sources linked below. How we use AI

Mozilla's San Francisco headquarters monument sign
Photo: Tmittelstaedt, CC BY-SA 4.0, via Wikimedia Commons
On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Firefox 159, released on 27 October 2026, fixes 167 security vulnerabilities in one go, and Mozilla credits OpenAI with 41 of them. Mozilla's advisory MFSA 2026-118 rates 108 of the bugs "high", none critical, and says nothing about any of them being exploited. The credit lines show AI-assisted bug finding in a mainstream browser's patch notes in numbers that are hard to ignore. If your Firefox has not restarted since late October, it is the update to install now.

Key points

  • Firefox 159 (27 October 2026) fixes 167 CVEs under Mozilla advisory MFSA 2026-118: 108 high, 52 moderate and 7 low severity, none rated critical.
  • Mozilla credits OpenAI with 41 of the 167: 34 to "OpenAI Codex Security (kylebot)" and 7 to Amy Burnett of OpenAI. All 41 are rated high.
  • Mozilla's own staff are credited with 102 entries, outside researchers with 65, and the advisory says it now publishes one advisory per memory-safety bug instead of bundling them.
  • Firefox 159.0.1 (3 November 2026) adds one more high-severity fix (CVE-2026-120572), and the Extended Support Release branches 153.6 and 115.44 carry 145 and 80 fixes.
  • The advisory does not say any of the bugs were used in attacks, and the coverage we read (PCWorld among it) does not report exploitation either.

What to do

  • Update to Firefox 159.0.1 or later. On desktop, open the menu, then Help, then About Firefox; the page checks for the update and offers a restart. Firefox for Android updates through Google Play, and you can download current builds from firefox.com.
  • Check the version. Anything below 159 still has the bugs described here. 159.0 and 159.0.1 are both patched against MFSA 2026-118, and 159.0.1 also carries the one extra high-severity fix.
  • Firefox ESR users: the fixes are in ESR 153.6 (MFSA 2026-120, 145 CVEs) and ESR 115.44 (MFSA 2026-119, 80 CVEs). ESR 115 is the branch kept for older operating systems that current Firefox no longer supports, so those machines get this update only through 115.44.
  • Managed fleets: if you control updates through policy, check that the 159.0.1 build, not just 159.0, is what you are approving.
  • Thunderbird shares the same engine and has its own advisories published the same day (MFSA 2026-121 and 2026-122).

What happened

Mozilla published MFSA 2026-118 on 27 October 2026, the day Firefox 159 reached the release channel. The advisory is headed "Security Vulnerabilities fixed in Firefox 159" and lists 167 separate CVE numbers, from CVE-2026-117860 onward. By Mozilla's own severity labels, 108 are high, 52 are moderate and 7 are low. Mozilla's impact scale also has a "critical" level, and none of the 167 uses it.

The bugs are overwhelmingly the kind that browsers have always had. Going by the titles on the advisory page, 97 of the 167 are use-after-free bugs, where code keeps using memory after it has been released. Another 13 are described as sandbox escapes, which matter because the sandbox is the layer meant to contain a compromised web page. Smaller groups cover same-origin policy bypasses, site isolation problems, privilege escalation, uninitialised memory and JIT miscompilation. By the component named in each title, the DOM has the most entries with 40, followed by Graphics with 23, Layout with 19, Networking with 12 and the JavaScript engine with 12. One entry (CVE-2026-118018) is a spoofing issue in the Downloads component of Firefox for Android; the rest are in the desktop engine code the advisory lists.

Mozilla also explains, in a note at the top of the page, that it has changed how it publishes. It says it "no longer" rolls internally found memory-safety bugs into a single catch-all CVE and now issues an advisory for every individual bug. That change alone makes the count look much larger than a comparable release would have a year ago, so the 167 should not be compared one-to-one with older Firefox releases that bundled their memory bugs.

The credits tell the other half of the story. "Mozilla" is listed as the reporter for 102 entries. The remaining 65 come from outside: 34 credited to "OpenAI Codex Security (kylebot)", 7 to Amy Burnett of OpenAI, and 24 to other named researchers such as Takashi Suzuki (3), Nguyen Tuan Hung (3), Nguyen Thanh Nguyen (2) and Minseong Kim (2).

Firefox 159 security fixes by severity (MFSA 2026-118)CVEs
Firefox 159 security fixes by severity (MFSA 2026-118) (CVEs)
CVEs
High108
Moderate52
Low7

Source: Mozilla Foundation Security Advisory 2026-118

Background

Browsers are among the most heavily attacked software on a typical computer, and memory-safety bugs such as use-after-free are the classic way into them. Mozilla runs a security bug bounty and its own staff find many bugs too: 102 of the 167 entries here are credited to Mozilla itself.

What is new is the volume of AI-assisted findings. OpenAI introduced GPT-6 Cyber on 5 November 2026, a model it rates "Critical" for cybersecurity capability under its Preparedness Framework and has restricted to approved customers. We covered that launch, including its ExploitGym score. BleepingComputer, reporting on OpenAI's announcement, said the model found 81 previously unknown high-severity Firefox vulnerabilities and helped produce patches, with a link to this same Mozilla advisory. We have not been able to open OpenAI's own announcement page (it returned an access error to our tools), so that figure is the outlet's account of OpenAI's claim, not something we confirmed.

OpenAI's other recent security work is also relevant: its Linux kernel research reported exploits for 948 distinct vulnerabilities in a single run. Together these point the same way: AI systems are now producing security reports at a rate that browser vendors have to absorb in a single release.

The numbers

The two Firefox figures that readers will want to compare do not match, and the difference is worth stating plainly. BleepingComputer's report of OpenAI's announcement says 81 Firefox bugs. Mozilla's Firefox 159 advisory credits OpenAI with 41. The two numbers may cover different time spans, different releases or different counting rules; neither Mozilla's page nor the articles we read explains the gap, so we do not try to.

The extended-support branches share most of the same bugs, so the fixes fan out across three advisories published the same day:

Security fixes per Firefox branch, October 27 2026 advisoriesCVEs
Security fixes per Firefox branch, October 27 2026 advisories (CVEs)
CVEs
Firefox 159167
Firefox ESR 153.6145
Firefox ESR 115.4480

Source: Mozilla advisories MFSA 2026-118, 2026-120 and 2026-119

For ESR 153.6 the advisory lists 95 high, 44 moderate and 6 low. For ESR 115.44, 72 are high, 7 moderate and 1 low. Our own count of those pages matches the totals PCWorld reported for the release (167 fixes, 108 high, 52 moderate, 7 low, 97 use-after-free, 13 sandbox escapes).

Reporter credits for the main release split like this:

Who reported the 167 Firefox 159 vulnerabilitiesCVEs
Who reported the 167 Firefox 159 vulnerabilities (CVEs)
CVEs
Mozilla102
OpenAI (Codex Security and Amy Burnett)41
Other outside researchers24

Source: Mozilla advisory MFSA 2026-118 (reporter field)

What it means

For Firefox users, the practical message is simple: restart and update. Browser bugs like use-after-free and sandbox escapes are what attackers chain together to run code from a web page, and the usual advice for any large batch of fixes applies. The longer a known-fixed bug stays unpatched on a machine, the easier it is to attack, because the fix itself shows attackers where to look.

For IT and security teams, the size of the release is a reminder to check that update channels actually deliver browser patches. ESR 115 users on old operating systems are in a special position: ESR 115.44 is the branch that carries these fixes for them, and PCWorld reports it covers Windows 7 and 8.1 and macOS 10.12 to 10.14 and stays available until March 2027.

For the industry, the credit lines are the story. Whether the count is 41 or 81, a single AI lab appears in a browser's advisory in numbers that used to take a whole community of researchers. Mozilla's decision to publish one advisory per bug also makes the volume visible, where bundling would have folded many of these into a single "memory safety bugs" entry. For developers of other large C++ code bases, the lesson is that triage capacity, not discovery, may become the bottleneck.

A caution on interpretation. The advisory credits "OpenAI Codex Security (kylebot)" for 34 entries and names a person, Amy Burnett of OpenAI, for 7. The 7 person-credited reports should not be described as autonomous tool findings; the advisory does not say how they were found.

What we don't know yet

  • Exploitation. Mozilla's advisory does not mention attacks in the wild, and we found no report of exploitation of any of the 167. That can change; check the advisory and CISA's catalogue of known exploited vulnerabilities.
  • The 41 versus 81 gap. Why OpenAI's figure (as reported by BleepingComputer) and Mozilla's crediting differ.
  • How the bugs were found. Mozilla's page lists reporters and bug numbers, not methods. Details of the tooling used are not in the advisory.
  • Patch quality. Mozilla shipped 159.0.1 a week later with one more high-severity fix, CVE-2026-120572 (incorrect boundary conditions in Layout). Whether further follow-ups are needed is not yet known.

What to watch next

  • Firefox's next release, and whether Mozilla keeps publishing per-bug advisories at this volume.
  • Whether Mozilla or OpenAI publish a joint write-up that reconciles the counts.
  • Any CISA known-exploited-vulnerability listing for a Firefox CVE from this batch.
  • Similar AI-credited batches in Chrome, which fixed 52 flaws in Chrome 156 and shipped more in Chrome 157.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next