Mozilla’s Security Advisory 2026-118, announced on October 27, 2026, identifies Firefox 159 as the release that fixes the listed vulnerabilities. Notebookcheck reports 167 fixes in total: 108 rated high, 52 moderate and 7 low. Mozilla’s advisory labels the overall impact high.
Three CVEs show different kinds of flaws
Mozilla’s advisory describes three high-impact vulnerabilities in different parts of Firefox. A use-after-free occurs when software tries to use memory after it has been released. A sandbox escape involves breaking out of an isolated environment.
| CVE | Flaw and Firefox component | Reporter named in Mozilla’s advisory |
| CVE-2026-117921 | Use-after-free in CSS Parsing and Computation | OpenAI Codex Security (kylebot) |
| CVE-2026-117876 | Use-after-free in Layout: Text and Fonts | Amy Burnett of OpenAI |
| CVE-2026-117861 | Sandbox escape in DOM: Navigation | Mozilla |
The Mozilla advisory gives the description, impact rating and reporter for each entry. The examples span memory-management bugs in CSS and text layout, as well as a sandbox escape in DOM navigation.
What the reporter credits add up to
Notebookcheck counts 34 entries credited to OpenAI Codex Security and 7 to OpenAI researcher Amy Burnett. Together, that is 41 of the 167 reported entries, or about 24.6%. The figure is a count of reporter credits in the advisory.
Why older vulnerability totals may differ
Mozilla says it now issues separate advisories for memory-safety bugs identified internally, rather than grouping them under one CVE. That change affects how entries are counted, so raw totals across Firefox releases are not directly comparable.
Check Firefox’s installed version
For desktop Firefox, Notebookcheck describes this update route: open Menu > Help > About Firefox. The window displays the installed version and downloads an update if one is available; Firefox then prompts you to restart.
