# Firefox: update to 159.0.1 and relaunch the browser

Canonical: https://www.oktsec.com/radar/firefox-cve-2026-120572
Publisher: Oktsec
Language: en
Published: 2026-11-04T20:47:43Z
Updated: 2026-11-04T20:47:43Z
Record reviewed: 2026-11-04T20:47:43Z
Latest evidence check: 2026-11-04T20:47:43Z
Disclosed: 2026-11-03

Mozilla fixed CVE-2026-120572 in Firefox 159.0.1 and rates it High. The advisory does not report active exploitation.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: Mozilla rates the flaw High and provides a corrected Firefox release. The published notice does not establish active exploitation or detailed attack prerequisites.
- Evidence: Attacks not established
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: Mozilla
- Products: Firefox
- CVEs: CVE-2026-120572

## Technical overview

Mozilla’s November 3 advisory identifies incorrect boundary conditions in the Layout: Block and Inline component. It names Firefox and lists 159.0.1 as the corrected release.

The notice does not establish remote code execution or active exploitation. Its product listing is not evidence that Firefox ESR or Thunderbird shares the same affected range.

Oktsec recommends verifying the browser after relaunch and tracking deployment exceptions. A downloaded installer alone does not show that existing sessions use the corrected code.

## Recommended response

Update Firefox to 159.0.1 or a later supported release containing the correction, relaunch and verify the running version.

Relevant to: Teams managing Firefox on workstations, shared endpoints and browser automation hosts.

## CVE attribution

- CVE-2026-120572: Mozilla — Firefox. [Source](https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/)

## Affected systems and fixes

### Firefox

Affected: Installations requiring the MFSA 2026-123 correction; the notice does not enumerate an earliest affected release.

Fixed release / action: 159.0.1

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.04
Checked: 2026-11-05T12:14:16.442Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-05T19:58:03.480Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-120572](https://api.first.org/data/v1/epss?cve=CVE-2026-120572): 0.33% probability of observed exploitation in the next 30 days; percentile 26.18%; score date 2026-11-05.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-05T19:58:03.480Z.

## Response checklist

1. **Locate Firefox installations** — Record browser versions and update policies, including shared endpoints and separate automation installations.
2. **Deploy the corrected release** — Use Mozilla’s official channel or the approved managed package. Check the applicable Mozilla advisory separately for ESR and other products.
3. **Relaunch and verify** — Save work and restart the browser. Confirm the executable actually running, and follow up on offline devices and failed updates.

## Relevance to AI environments

Oktsec recommends checking the separate browser runtime used by automation, where applicable.

## Sources

- [Mozilla MFSA 2026-123: Firefox 159.0.1](https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/) — Mozilla; Vendor notice; checked 2026-11-04T20:41:46Z

## Editorial record

- 2026-11-04T20:47:43Z: Added product scope, source evidence and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/firefox-cve-2026-120572) · [Build a response plan](https://www.oktsec.com/radar/firefox-cve-2026-120572#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=firefox-cve-2026-120572&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=firefox-cve-2026-120572&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.