Firefox users have a new security update to install. Mozilla’s November 3 advisory identifies Firefox 159.0.1 as the fixed release for a high-severity vulnerability in the browser’s layout code.
The issue, tracked as CVE-2026-120572, concerns incorrect boundary conditions in the Layout: Block and Inline component. Mozilla credits its own team with reporting the flaw and assigns it a high impact rating.
The public advisory is brief. It does not describe an exploit chain, give a CVSS score or state that the vulnerability has been exploited. Its linked Bugzilla record requires additional access permissions, limiting the technical detail available for independent assessment.
The distinction matters: a high severity rating is a reason to deploy the fix, but it does not establish an ongoing attack. The notice also does not enumerate earlier affected versions or identify an ESR fix, so organizations should avoid extending its scope to other Firefox release channels without checking the corresponding advisory.
Install the update, then restart
For a standard Mozilla installation, open the browser menu, choose Help and then About Firefox. On macOS, use Firefox > About Firefox. According to Mozilla’s update instructions, the browser checks for updates from that window and downloads an available release. Complete the restart when prompted; updates take effect after Firefox restarts.
Update delivery depends on how Firefox was installed. Linux distribution packages use the system’s software update mechanism, while Microsoft Store installations receive updates through the Store. Administrators should use the appropriate managed update channel and confirm that endpoints are running the corrected release.
