Mozilla has shipped Firefox 159.0.1, a point release that fixes a high-severity security flaw in the browser's layout engine. The update reached Release channel users on 3 November 2026, a week after Firefox 159.0 launched on 27 October. Anyone still on 159.0 should update now, because the earlier release does not contain this fix.

What the flaw is

The flaw is tracked as CVE-2026-120572 and described by Mozilla as incorrect boundary conditions in the Layout: Block and Inline component, the part of the engine that works out where text and boxes go on a web page. Mozilla reported the issue itself, and its advisory, MFSA 2026-123, rates the impact as high. The CVE record carries a CVSS 3.1 score of 8.8. Mozilla's advisory gives no attack scenario and does not say the flaw has been exploited, so there is no evidence of attacks in the wild — but a high-rated browser flaw is still worth patching promptly.

What else the update fixes

The release also repairs everyday problems. Passkey sign-in now works on sites that share passkeys, including Facebook and Instagram, and Windows crashes linked to some antivirus and security software are fixed. On Linux, it corrects swapped red and blue colours in some WebGL scenes, and it updates time zone data after Cuba decided to keep daylight saving time beyond 1 November. Smaller fixes cover a hard-to-see tab attention dot and Settings text breaking mid-word.

What to do

Open About Firefox and let the browser check for updates, then restart when it asks. If about:support still shows 159.0 or anything older, the security fix is not installed. The update is free, takes a few minutes, and is the only way to get the CVE-2026-120572 fix on the desktop Release channel.