Mozilla published high-severity security advisories on November 10 for Firefox and Firefox Extended Support Release (ESR), the browser branch used by many organizations. The fixes are included in Firefox 160, Firefox ESR 153.7 and Firefox ESR 115.45. Match the update to the branch deployed on each device.
The advisories cover memory-safety problems, sandbox escapes and other weaknesses in browser components. For example, CVE-2026-124853 affects graphics boundary handling and can permit a sandbox escape, while CVE-2026-124857 is a graphics use-after-free flaw. A sandbox is a containment boundary intended to limit what browser content can access; escaping it can increase the consequences of another weakness.
MS-ISAC advisory 2026-131 reports no known exploitation in the wild as of November 10. It warns that the most severe flaws could allow arbitrary code execution. This is a risk statement, not evidence of an active exploitation campaign, and not every issue applies to every Firefox branch.
Inventory Firefox and ESR installations, test and deploy the appropriate supported update, restart the browser when required, and confirm the installed version. Retain least-privilege accounts and endpoint protections. Consult the release-specific advisory for the exact issues addressed; do not apply one branch's version number to another.
Sources: Firefox 160, MFSA 2026-125; Firefox ESR 153.7, MFSA 2026-127; Firefox ESR 115.45, MFSA 2026-126.
Attribution: MS-ISAC TLP:CLEAR advisory 2026-131, issued November 10, 2026.