Firefox 160 fixes nearly 100 flaws, including sandbox escapes; Chrome and Apple ship patches too

Mozilla released Firefox 160 on November 10, 2026, fixing 99 security vulnerabilities, including several sandbox escapes — flaws that could let a malicious website break out of the browser's isolated environment. In the same week, Google patched a Chrome zero-day and Apple shipped iOS 27.2.1 with fixes for iMessage. It is a week to update your browser and phone without delay.

Firefox 160: 99 CVEs and sandbox escapes

According to Mozilla's official bulletin, Mozilla Foundation Security Advisory 2026-125, Firefox 160 fixes 99 CVEs: 57 rated high impact, 24 moderate and 18 low. Among the most serious are sandbox escapes in the graphics and text components (CVE-2026-124853), DOM navigation (CVE-2026-124855), the Storage Cache API (CVE-2026-124859), audio and video (CVE-2026-124861) and service workers (CVE-2026-124864, with a CVSS score of 9.6). The fixes also reach the extended support releases, Firefox ESR 153.7 and ESR 115.45, and Tor Browser 16.0.1 includes the same patches. Mozilla has not reported any of these flaws as actively exploited — which does not make the update any less urgent.

Beyond security, Firefox 160 adds Mini Window, which lets you pop a tab — or part of a page — into a small always-on-top window, plus speed controls for picture-in-picture.

Chrome patches a zero-day, its sixth this year

Google released Chrome 157.0.8103.50 with nine security fixes, including CVE-2026-125350, described as the sixth Chrome zero-day of 2026. The update follows the Chrome 157 stable release of November 3, which had already fixed 213 flaws, seven of them critical. Users of Chromium-based browsers such as Edge should also watch for the matching updates.

Apple: iOS 27.2.1 fixes iMessage flaws

On November 9, Apple released out-of-cycle updates — iOS 27.2.1, iPadOS 27.2.1, macOS 27.2.1, watchOS 27.2.1 and visionOS 27.2.1 — fixing nine vulnerabilities on iPhone and iPad. The most sensitive are in iMessage: one flaw (CVE-2026-113961) could let a remote attacker join a group chat and receive its messages, and another (CVE-2026-113960) could let someone added to a group read messages sent before they joined. The updates also fix AirPlay and Bluetooth flaws. Devices on older branches get the same fixes in iOS 26.7.3 and iOS 18.7.12. Apple has not reported active exploitation of these flaws.

A week of patches

The wave of fixes completes Microsoft's November Patch Tuesday, which addressed 1,093 flaws — including an already-exploited Outlook zero-day — covered in an earlier Geekiki article. The previous browser round, Chrome 156 and Firefox 159, had fixed 219 flaws at the end of October. The advice is the same as ever: update your browser and operating system now instead of waiting for the next cycle.

Cover image: screenshot of the Mozilla Firefox browser, via Wikimedia Commons.

Fontes

Transparency: this article was produced with the help of artificial intelligence, cross-checking public posts and internet sources. Please consult the original sources listed below to confirm the information.

Muse