Firefox 159 fixes over 100 high-severity bugs, some found by OpenAI
Mozilla's MFSA 2026-118 lists at least 144 individual CVEs for Firefox 159, continuing a disclosure change that stopped bundling internal memory-safety bugs into one catch-all ID. None is flagged as exploited in the wild.
Mozilla published MFSA 2026-118 on 27 October, the security advisory for Firefox 159. It continues a disclosure change Mozilla made with Firefox 158: rather than rolling internally found memory-safety bugs into one catch-all CVE, each gets its own entry with its own reporter and Bugzilla reference.
The advisory lists at least 144 individual CVEs, with at least 108 rated high and the rest moderate. Several are sandbox escapes, including CVE-2026-117861 in the DOM Navigation component and CVE-2026-117868 in DOM Networking, alongside a same-origin policy bypass tracked as CVE-2026-117860. None is flagged as exploited in the wild. A notable share of the high-severity entries, including CVE-2026-117868, are credited to OpenAI’s security researchers rather than Mozilla’s own team or the usual outside bug-bounty hunters.
Why it matters: sandbox escapes are the building block that turns a malicious page into a full browser compromise once chained with another bug. None of these is known to be exploited yet, but the volume and the credits are worth noting either way: AI-assisted vulnerability research is now finding this class of bug in a major browser at a scale that used to need an entire fuzzing team.
The caveat: Mozilla’s advisory page is long enough that even a careful read can undercount the true total, so treat 144 as a floor rather than a final figure.