IT & SecurityCreated on October 28, 20262 min read

Firefox 159 and ESR: choose the security update for your branch

Mozilla published high-impact security advisories on October 27. Standard Firefox and the ESR branches have separate fixed releases.

What changed

Mozilla’s October 27 advisories list fixes in Firefox 159, Firefox ESR 153.6 and Firefox ESR 115.44. Their overall impact rating is high. The standard-release advisory includes same-origin and sandbox issues.

Why it matters

Use the advisory for the branch you actually run. Separate ESR notices list their own issues; a version on one branch is not a replacement version number for another. Managed developer machines and administration browsers deserve the same inventory as everyday browsers.

What to do

Check Firefox’s installed version and whether it belongs to an ESR branch.
Update through Mozilla or your organisation’s supported package channel, then restart. Do not disable the sandbox to work around a compatibility problem.

Reference commands

Open in Firefox to inspect the installed version and environment

about:support

Verify the result

Confirm the running build after restart and re-test login, uploads and your main application flows. An outdated version calls for remediation; it does not alone prove compromise.

Official sources

Take it into your project

Get the files, keep the guide, or give your coding assistant a ready-to-use brief.

Download guideMarkdown Download AI setup briefEnglish · Markdown

Set it up with AI

Copy this English prompt into your coding assistant. It includes the article, available files and project setup steps.

View the setup prompt

AI setup prompt · English

Read this news or bug-fix article as reference material:
https://nethanelfitoussi.com/article/firefox-159-esr-october-27-security-fixes?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Use the article and its examples as references. Identify any missing project files before making changes.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Review Mozilla’s 27 October 2026 advisories MFSA 2026-118, 2026-120 and 2026-119 at https://www.mozilla.org/en-US/security/advisories/ . Inventory desktop Firefox installations and the ESR branch on managed devices. Compare them to Firefox 159, ESR 153.6 or ESR 115.44 as appropriate; consult the separate advisory for each branch rather than assuming identical CVE coverage. Plan updates through the existing official or organisation-managed channel and verify the running version after restart. Separately inventory browser automation runtimes. Keep sandbox and site-isolation protections enabled. Do not infer exploitation from an outdated version or run proof-of-concept payloads.

Check the dated advisory and current official vendor guidance. Identify whether my installed version and configuration are affected before proposing a fix.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.

The prompt

Review Mozilla’s 27 October 2026 advisories MFSA 2026-118, 2026-120 and 2026-119 at https://www.mozilla.org/en-US/security/advisories/ . Inventory desktop Firefox installations and the ESR branch on managed devices. Compare them to Firefox 159, ESR 153.6 or ESR 115.44 as appropriate; consult the separate advisory for each branch rather than assuming identical CVE coverage. Plan updates through the existing official or organisation-managed channel and verify the running version after restart. Separately inventory browser automation runtimes. Keep sandbox and site-isolation protections enabled. Do not infer exploitation from an outdated version or run proof-of-concept payloads.

Read the original sourceMozilla · Firefox 159 · MFSA 2026-118

Firefox 159ESRBrowser security