Mozilla released Firefox 159 on October 27, 2026, fixing 167 security vulnerabilities and turning on scroll-driven animations and scoped custom element registries for web developers. The version was first offered to users on Firefox’s release channel that day.

Mozilla’s security advisory for the release, Mozilla Foundation Security Advisory (MFSA) 2026-118, rates its overall impact as high. Of the 167 Common Vulnerabilities and Exposures (CVE) entries it lists, 108 are rated high, 52 moderate and seven low, and all are fixed in Firefox 159. The advisory does not say that any of them were exploited in the wild.

The listed flaws include sandbox escapes, use-after-free bugs and privilege escalation issues across components such as networking, graphics, layout and the JavaScript garbage collector. The first two entries, CVE-2026-117860 and CVE-2026-117861, are a same-origin policy bypass and a sandbox escape in the Document Object Model (DOM) navigation component.

The advisory also notes a change in how Mozilla reports some bugs: “We no longer roll all internally identified memory safety vulnerabilities into a single CVE,” it says, adding that Mozilla now issues an advisory for every individual bug.

Web platform changes

According to MDN Web Docs’ release notes for developers, scroll-driven animations are now enabled by default. MDN says they “allow you to animate property values along a scroll-based timeline” instead of the default time-based document timeline. Firefox’s release notes list the animation-timeline, scroll-timeline, view-timeline and animation-range properties and the ScrollTimeline and ViewTimeline interfaces as part of the feature.

Scoped custom element registries let a shadow tree create its own CustomElementRegistry whose definitions apply only to that part of the page. MDN says this “can be used to avoid collisions where multiple web components declare elements with the same name.” The HTML Sanitizer API now removes unwanted elements and attributes during parsing rather than afterward, and WebGL gains the EXT_clip_control and EXT_texture_mirror_clamp_to_edge extensions on supported drivers, with EXT_texture_norm16 enabled for WebGL 2.

The release removes the legacy CSS masonry syntax, which MDN says had been enabled by default only in Nightly builds and is superseded by grid lanes layout, using the grid-lanes and inline-grid-lanes display values. For browser automation, the –remote-allow-system-access command-line argument is gone in favor of the MOZ_REMOTE_ALLOW_SYSTEM_ACCESS=1 environment variable, and WebDriver BiDi adds an emulation.setMediaFeaturesOverride command that currently supports only prefers-color-scheme.

Changes for users

On macOS, sharing now uses the native share picker and can send several selected tabs at once. Saved passwords appear in the sidebar by default “without having to add the Passwords tool first,” and open tabs can be searched with Ctrl+Shift+A on Windows and Linux or Cmd+Shift+A on macOS.

The Summarize option in Firefox’s AI chatbot feature “now sends the page’s address to the chatbot provider instead of the page’s text,” which Mozilla said means long pages are no longer cut short into partial summaries. A Smart Window feature that watches pages for changes such as price drops or restocks, set up by typing /watch in the chat, is rolling out progressively.

Fixes include sites such as Slack failing to load instead of falling back to HTTP/2 when they rejected an HTTP/3 request, and bookmarks not being imported from Google Chrome profiles signed in to a Google account.

Why it matters

With more than 100 high-impact vulnerabilities addressed, Firefox 159 is a security update as much as a feature release, and the advisory names it as the fixed version for every listed CVE. The per-bug reporting change means advisory totals are not directly comparable with older releases that grouped memory safety bugs into a single entry.

The Summarize change alters what the browser sends when the feature is used: the chatbot provider now receives the page’s address rather than its text. For web developers, scroll-driven animations and scoped custom element registries are now on by default in the release channel, while pages that relied on the old Nightly-only masonry syntax need to move to grid lanes.

Context

Firefox 159 follows Firefox 158, released on October 13, which added JPEG XL image support, Albanian, Belarusian and Filipino to the browser’s translation feature, and smoother scrolling by no longer rounding scroll positions to whole screen pixels.

Corrections and tips: email the editor using the address on the Contact page.