Firefox 159.0.1 fixes high-impact CVE-2026-120572

Mozilla has released Firefox 159.0.1 to address CVE-2026-120572, which the vendor rates as high impact. The flaw involves incorrect boundary conditions in the Layout: Block and Inline page-layout component.

The official advisory is brief and does not describe a public exploit or confirmed attacks. That is not a reason to defer the update: a browser continuously processes content from untrusted websites, and a corrected release is already available.

The priority action: update Firefox to 159.0.1 or later, restart the browser and confirm the complete version number. In a business environment, verify the running version on every profile and device rather than relying on a package-download status alone.

What is known about CVE-2026-120572

Mozilla announced the fix on November 3, 2026. The vulnerability is in the engine responsible for laying out block and inline page elements. The vendor marks its impact as high and says Firefox 159.0.1 resolves the issue.

Boundary conditions define how software behaves at the edges of permitted ranges and with unusual combinations of data. A mistake in this class can produce incorrect memory access or unexpected behaviour. Mozilla’s public advisory does not provide a detailed abuse scenario, however, so it would be inaccurate to claim a specific impact that the vendor has not documented.

For users, the practical fact is simple: Firefox releases older than 159.0.1 do not contain this fix. The advisory covers the standard Firefox channel and does not list a separate ESR release in this notice.

Is CVE-2026-120572 actively exploited?

Mozilla advisory MFSA 2026-123 does not report exploitation in real-world attacks. It also does not provide evidence of public proof-of-concept code. CVE-2026-120572 should therefore not be labelled a confirmed zero-day on the currently available evidence.

No reported exploitation does not mean no risk. Browsers are permanently exposed to documents and web applications controlled by third parties. Moving to the fixed release is typically faster and cheaper than trying to determine whether every visited website can reach the flawed rendering path.

How to update Firefox to version 159.0.1

Individual users

1. Open the Firefox menu and select Help → About Firefox.
2. Allow the built-in updater to download the release.
3. Restart Firefox when prompted.
4. Open the same window again and confirm 159.0.1 or later.

Do not download an “urgent Firefox patch” from an advert, email or unfamiliar website. Use the built-in update mechanism, Mozilla’s official site or your operating system’s trusted package repository.

Businesses and IT teams

Administrators should verify the version actually running after restart, not just a successful deployment job. Reporting should separate:

• devices running Firefox 159.0.1 or later;
• systems where the package is downloaded but the application awaits restart;
• inactive or unreachable devices;
• user-installed copies outside the standard application path;
• systems where a legacy extension or business application blocks the update.

Prioritise workstations used for finance, administration, privileged email, cloud consoles and management systems. Then set a short compliance deadline for the wider fleet and keep exceptions visible until they are closed.

Why automatic updates may not be enough

Firefox can download a fix in the background while the old browser process continues until restart. A user with many open tabs may postpone that restart for days. Enterprise reporting should measure the running version or post-restart state rather than only the package present on disk.

Other blind spots include rarely connected laptops, dormant virtual machines and local accounts with separate browser installations. A good vulnerability process combines MDM or EDR data, software inventory and the device’s last check-in. Our vulnerability management guide explains the wider prioritisation model.

What to tell employees

A short instruction works better than a technical bulletin: “Close and restart Firefox, then check that your version is at least 159.0.1.” Include a screenshot showing where the number appears and a completion deadline.

This is also a useful moment to remind people that a genuine browser update does not ask for an email password or payment-card details on a website. Criminals routinely turn widely reported vulnerabilities into phishing themes and fake installers.

Source facts and Breachroad conclusions

Mozilla confirms the publication date, high impact rating, Layout: Block and Inline component, CVE-2026-120572 identifier and Firefox 159.0.1 as the fixed release. The official advisory does not report active exploitation.

Business deployment order, restart reporting, discovery of non-standard installations and employee messaging are Breachroad recommendations. Cybersecurity awareness training helps teams distinguish genuine updates from fake notices, while an IT security audit can assess fleet coverage and the vulnerability-remediation process.

FAQ: Firefox 159.0.1 and CVE-2026-120572

Which Firefox version fixes CVE-2026-120572?

Mozilla identifies Firefox 159.0.1. The safe target is that build or any newer stable release supplied by the vendor.

Is downloading the update sufficient?

Not always. The browser generally needs to restart before the new version is active. Confirm the number in the About Firefox window after restart.

Is the vulnerability being exploited?

The official advisory does not report active exploitation. CVE-2026-120572 should not be presented as a confirmed zero-day without new evidence.

Do I need to uninstall Firefox?

No. The standard remediation is an update to 159.0.1 or later. Reinstallation is relevant only under a local business policy or when the existing installation is damaged.

Primary sources: Mozilla — MFSA 2026-123, Mozilla — update Firefox, Mozilla — security advisories.