Mozilla fixes high-impact browser flaws in Firefox 159, crediting OpenAI researchers

Mozilla’s Firefox 159 fixes high-impact security flaws across the browser, including sandbox escapes and privilege escalation. Its October 27, 2026 security advisory credits multiple reports to OpenAI Codex Security and an OpenAI researcher. The disclosure also marks a change in presentation: Mozilla now gives each internally identified memory-safety bug an individual advisory.

Fixes across the browser

Security Advisory 2026-118 identifies Firefox 159 as the fixed version and assigns a high-impact rating to the listed vulnerabilities. The issues reach well beyond one browser feature. They include navigation, networking, graphics, audio and video, page layout, storage and the JavaScript engine.

Mozilla lists sandbox escapes in the navigation, form-management and networking components. It also identifies same-origin policy bypasses in navigation and CSS parsing and computation. Separate privilege-escalation entries affect navigation, networking, graphics and WebRTC, including its signaling and networking components. These are distinct entries, each carrying its own vulnerability identifier and bug reference.

Memory-related problems make up many entries. Mozilla repeatedly lists use-after-free vulnerabilities, alongside invalid pointers, uninitialized memory and incorrect boundary conditions. One audio/video flaw is explicitly labeled information disclosure due to uninitialized memory. A graphics-text entry combines integer overflow and use-after-free, while the JavaScript engine’s just-in-time compilation component has a miscompilation entry.

Where OpenAI appears in the credits

The reporter credits distinguish between Amy Burnett of OpenAI and OpenAI Codex Security (kylebot). Burnett is named on seven entries spanning text and fonts, IndexedDB storage, tables, navigation, layout, and core HTML and HTML parsing. Those credits include both memory-related flaws and a privilege-escalation vulnerability.

The OpenAI Codex Security credits likewise cover several browser subsystems rather than a single cluster of identical component names. Examples in Mozilla’s advisory show the range:

• CVE-2026-117921 and CVE-2026-117922: use-after-free flaws in CSS parsing and computation and in WebSockets networking, respectively.
• CVE-2026-117933 and CVE-2026-118011: two entries labeled frame poisoning in the CSS parsing and computation component.
• CVE-2026-117942 and CVE-2026-118014: incorrect boundary conditions and use-after-free, respectively, in the JavaScript engine’s just-in-time compilation component.

Mozilla is also named as the reporter on numerous entries, including sandbox escapes, privilege escalations and use-after-free bugs. Other credited reporters include satyamasd, Yaqoub Aldurayhim, Takashi Suzuki and Minseong Kim. The OpenAI-linked submissions are therefore part of a larger collection of fixes, not the sole source of the advisory’s findings.

We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

Mozilla Foundation Security Advisory 2026-118

Individual bugs, individual records

Instead of combining them under one CVE—the vulnerability identifier attached to an entry—it now publishes an advisory for each bug. In this disclosure, individual entries carry a component, reporter, impact rating and reference to a numbered Mozilla bug.