Mozilla fixed CVE-2026-120572 in its desktop browser. Canada’s cyber agency highlighted the patch in an advisory on Friday.
Mozilla has issued a security update for Firefox after finding a flaw in the code that lays out web pages. Mozilla rated the issue high impact and identified Firefox 159.0.1, released on 3 November, as the fixed version. The Canadian Centre for Cyber Security drew attention to the update in an advisory on Friday.
The flaw, tracked as CVE-2026-120572, involves incorrect boundary conditions in Firefox’s block and inline layout component. That part of the browser works out where content goes on a page, from blocks such as paragraphs to the pieces of text and other elements that share a line.
The point release has its own advisory
Mozilla documented the issue in security advisory MFSA 2026-123 and listed bug 2079035 as its technical reference. The public notice specifies the affected component, the severity and the version that contains the fix.
Firefox 159, the preceding release, had its own security advisory. Mozilla listed different fixes in that version, including for failures in how the browser separates the contents of websites. For the layout vulnerability, the relevant version on the regular desktop release line is 159.0.1.
Installation and deployment are separate checks
On a desktop copy of Firefox that updates itself, the About Firefox window shows the installed version and checks for a newer build. Mozilla’s support guide says to restart the browser after the update downloads. Some Linux installations receive updates through the distribution’s package manager.
In managed environments, the version running on a workstation can lag the version approved for deployment. Browser inventories and endpoint reports can help administrators verify which machines are already running the fixed build and which still need a restart or package update.
Mozilla tracks release channels separately
The advisory names the regular desktop Firefox release. Mozilla maintains a separate list of security advisories for the Extended Support Release used in some managed environments, with its own version numbers.
Keeping those channels separate makes version checks easier to interpret. A support team can match the installed channel against Mozilla’s advisory for that product before deciding whether a device needs attention.
Sources
Mozilla Foundation — advisory MFSA 2026-123
Canadian Centre for Cyber Security — advisory AV26-1131
