Check the release line before checking the version
Mozilla issued desktop Firefox security advisories on November 10 for the regular release and two Extended Support Release lines. The fixed versions are Firefox 160 for the regular release, Firefox ESR 153.7 for the 153 series and Firefox ESR 115.45 for the 115 series. The three numbers matter for organizations that keep managed machines on an ESR line.
The desktop advisories are separate from the Firefox 160 update for iOS announced on November 9. A phone and a desktop can show the same major version even though Mozilla reports their fixes in different advisories.
The patch lists overlap
Mozilla rates each desktop advisory high impact. All three include CVE-2026-124853, a sandbox escape in text graphics, and CVE-2026-124859, another escape involving the browser’s cache storage interface. A sandbox is designed to limit what a browser process can access. A flaw that lets code escape that boundary matters even when it is only one part of a potential attack.
The lists also differ by release line. CGH’s reading is that administrators should compare their installed build with the advisory for its own line. An ESR device can receive its security fix while retaining the major version its organization has approved.
Availability and limits
Mozilla’s advisories identify fixed upstream versions without listing country-specific restrictions or a purchase price. Timing can differ for an installation updated through a managed software catalog or operating-system package manager. CGH reviewed the advisories without installing the updates or testing the vulnerabilities.