Mozilla first offered Firefox 159.0 to Release-channel users on October 27, 2026. Security Advisory 2026-118 lists 167 vulnerability entries: 108 high impact, 52 moderate, and seven low, with none rated critical. Mozilla classifies the advisory’s overall impact as high (the advisory; Firefox 159 release notes).
What Mozilla lists in the Firefox 159 advisory
| Impact category | Advisory entries |
| High | 108 |
| Moderate | 52 |
| Low | 7 |
| Critical | None listed |
| Total | 167 |
The advisory identifies each issue by its affected component, type, impact, reporter, and Bugzilla reference. BrenTech’s English-language overview also shows the Firefox About dialog displaying version 159.0.
Three entries name affected Firefox components
The advisory’s examples show how the listed defects span different parts of the browser. CVE-2026-117860 is a high-impact same-origin-policy bypass in DOM Navigation. CVE-2026-117861 is a high-impact sandbox escape in the same component. CVE-2026-117876 is a high-impact use-after-free in Layout: Text and Fonts; Mozilla credits Amy Burnett of OpenAI as its reporter (Mozilla’s advisory).
Why older advisory counts may differ
Mozilla says it now gives each internally identified memory-safety bug a separate entry instead of grouping such bugs under one CVE. The change affects how Firefox 159’s entry count compares with counts in older advisories (Mozilla’s advisory).
What the Linux Mint package index listed
A November 1, 2026 snapshot of Linux Mint’s upstream Firefox package index listed version 158.0.1+linuxmint1, with that package entry dated October 22; the snapshot did not list Firefox 159.0 (Linux Mint’s package index). Mozilla had offered Firefox 159.0 to Release-channel users on October 27, a separate release stream documented in Firefox’s release notes.
