Mozilla has released Firefox 160, a security update that fixes 99 vulnerabilities in the browser, including several flaws that could let a malicious website break out of the browser's sandbox. The update was published on 10 November 2026 under Mozilla Foundation Security Advisory 2026-125, and users are urged to install it without delay.

The sandbox is the barrier that keeps website code confined to the browser. A sandbox escape breaks that barrier, allowing code that is already running inside a web page to reach the rest of the computer with the browser's own privileges. That is why the sandbox escapes in this release matter more than the raw count of fixes, even though the count itself is large.

What Firefox 160 fixes

According to Ivanti's summary of the release, Firefox 160 resolves 99 CVEs: 57 rated High, 24 Moderate and 18 Low. The extended support releases were updated at the same time. Firefox ESR 153.7 resolves 81 flaws, and Firefox ESR 115.45 resolves 28, all of them rated High.

Mozilla's advisory, MFSA 2026-125, rates the overall impact of the release as high. Many of the High-rated issues are use-after-free and memory boundary flaws across graphics, the document object model, layout and JavaScript components. Ivanti notes that about a quarter of the fixes in Firefox 160 are credited to researchers at OpenAI, continuing a pattern seen in the previous release.

The sandbox escapes to prioritise

Several of the flaws in this release are sandbox escapes. CVE-2026-124853 is a sandbox escape caused by incorrect boundary conditions in the Graphics: Text component, and the public CVE record lists it with a CVSS score of 9.6. CVE-2026-124855 is a sandbox escape in the DOM Navigation component, and CVE-2026-124859 is a sandbox escape linked to incorrect boundary conditions in the Storage Cache API.

Two further escapes involve use-after-free flaws: CVE-2026-124861 in the Audio/Video cubeb component and CVE-2026-124864 in the DOM Service Workers component. Ivanti also highlights CVE-2026-124907, a use-after-free in WebGL that allows privilege escalation and a sandbox escape. A use-after-free flaw occurs when software continues to use memory after it has been released, which an attacker can exploit to corrupt memory and run code.

Other fixes in the release cover memory safety in the JavaScript garbage collector, including CVE-2026-124870, a buffer overflow rated 8.8, and a range of flaws in graphics, networking, audio and video processing, HTML parsing and storage APIs. The Tor Project also released Tor Browser 16.0.1 on 10 November 2026, based on the same Firefox code.

No exploitation reported so far

Mozilla's advisories do not report any of these vulnerabilities as actively exploited, and the flaws should not be treated as confirmed attacks. That does not make the update optional. Sandbox escapes are the kind of flaw that attackers value most in a browser, because a single malicious page can be enough to reach a victim, and the fixes are already available.

Users on the standard release should update to Firefox 160. Organisations on the extended support releases should move to Firefox ESR 153.7 or ESR 115.45, depending on which branch they run. The update is available through the browser's built-in updater and from Mozilla's download pages.

Firefox 160 arrives in the same week as a very large November Patch Tuesday from Microsoft and major updates from Adobe, Google and SAP, making it one of the busiest patching weeks of the year. For most home users, the practical step is simple: restart the browser, let the update install, and check that the version number reads 160.