The security fixes
Most of the 167 fixes are memory safety bugs, and the most common type by far is use-after-freethe program keeps using a piece of memory after releasing it; an attacker who controls what gets written there can sometimes take over the program. They are spread across the layout engine, the JavaScript engine and its JIT compilerthe part of the browser that turns JavaScript into fast machine code while the page runs, graphics, networking and WebRTC.
Several high-impact entries are labelled sandbox escapea flaw that lets code break out of the restricted area where the browser runs web content and reach the rest of the computer, for example in the Form Manager and the DOM navigation code. Others are same-origin policy bypasses, which can let one website read data from another.
Mozilla rates the advisory as high impact overall. It does not mark any of the issues as exploited in the wild, and it does not publish technical details beyond a one-line title for each CVE.
What else is new
Smart Window can now watch a page and tell you when it changes, for example when a price drops or a product is back in stock. You set it up by typing /watch in the chat, and Mozilla is turning it on gradually.
Saved passwords now show in the sidebar by default. On macOS, sharing goes through the system share sheet and can send several tabs at once. The AI chatbot's Summarize option sends the page address instead of the page text, which stops long pages from being cut off.
Mozilla also fixed memory growth in minimized windows, excessive memory use on Linux with AMD graphics and Chrome bookmark imports from signed-in Google profiles.
Two shortcuts changed
Search through open tabs is now Ctrl+Shift+A on Windows and Linux, Cmd+Shift+A on macOS. The Extensions and Themes page moved to Ctrl+Shift+F or Cmd+Shift+E. You can change both in about:keyboard.
How to update
Firefox updates itself in the background. To check, open the menu, choose Help > About Firefox, and let it download the latest version, then restart. Companies on the Extended Support Release follow a separate schedule and should check the ESR advisories.
Browsers were not the only software patched that week. Phones got 216 fixes in the Android November 2026 security bulletin, and if you run a website, check our analysis of the exploited WordPress flaw CVE-2026-119977.
Sources
Primary sources we checked for this article: