Firefox 159 security update: what VPN users should check

Cover: AI-generated editorial illustration, not an event photograph or product screenshot.

Firefox 159 was released on 27 October 2026 with security fixes, and Mozilla rates its accompanying security advisory as high impact. For readers using the regular desktop release, the useful action is to check the installed version, complete the update through its normal channel and restart the browser. A connected VPN is not a substitute for that browser update.

Mozilla also published separate advisories for Firefox ESR 153.6 and ESR 115.44 on the same date. These are different release branches with their own affected-issue lists. If your employer manages Firefox, check the approved branch with IT rather than installing a different edition merely because its version number is higher.

What Mozilla announced

The Firefox 159 security advisory identifies issues including a same-origin policy bypass, CVE-2026-117860, and a sandbox escape, CVE-2026-117861, both in the DOM Navigation component. These are Mozilla’s classifications; VPNBlade has not reproduced the vulnerabilities or tested an exploit. The advisory is evidence of fixes, not evidence that a particular reader’s computer has been compromised.

There are everyday interface changes too. The release notes describe native macOS sharing and saved passwords appearing in the sidebar by default. Smart Window’s page-watching feature is described as a progressive rollout, so its appearance should not be used as proof that an update succeeded or failed. Check the version directly instead.

The security reason to update stands independently of whether those features interest you. A useful distinction is between a release becoming available and that release actually running on your device. Downloading an installer, seeing an update notification and finishing the browser restart are different stages of that process.

Why browser boundaries matter to privacy

MDN describes the same-origin policy as a boundary limiting interaction between documents or scripts from different origins. Its purpose is to help isolate potentially malicious content. In everyday terms, opening several unrelated websites should not give one page unrestricted access to everything happening in another.

A VPN works at a different part of the connection. As our guide to how a VPN works explains, its tunnel changes how covered traffic travels between your device and a VPN endpoint. It does not rewrite vulnerable browser code. The distinction matters because a reassuring connected icon can otherwise create the wrong sense that all security maintenance is complete.

Consider a reader checking an account from a hotel. There are several separate questions: is the browser current, is the website genuine, is the account protected, and is the network connection being handled as intended? Answering one does not settle the others. Treating these as separate checks is more useful than buying another product in response to every security headline.

Which Firefox update route should you use?

Mozilla’s update instructions distinguish the downloaded desktop edition from Store and Linux-package installations. For the downloaded edition, the About Firefox window checks for updates; installation requires restarting Firefox. Save unfinished work first. After reopening, check the displayed version again rather than relying on the earlier notification.

If you have more than one browser shortcut, repeat that check in the browser you actually use for sensitive tasks. An updated copy sitting unused does not establish that the copy opened by another shortcut is current. On a shared computer, a simple note of the browser edition, installation route and completed check can prevent repeated confusion.

What this means for VPN users and browser extensions

A browser extension, desktop VPN app and browser update have different jobs. Do not uninstall a working VPN simply because Firefox has a security advisory. Equally, do not assume that an extension described as a VPN provides the same scope as a device-level app. Our browser extension comparison explains what to compare before choosing one.

After updating, make a small functional check: open an ordinary page, confirm the VPN app still reports its expected state and verify any extension you rely on is enabled. These checks are practical observations, not proof that every possible leak or security issue has been eliminated. If something stops working, record the browser version and the exact error before changing multiple settings.

Our VPN troubleshooting guide separates account, network and application problems. That is a better starting point than treating any failed page load as evidence that the security update broke the VPN. Avoid permanently turning off protective controls just to make an error disappear.

Comparing a VPN for a separate privacy need?

You do not need to purchase a VPN to install this Firefox update. If you already want a VPN for a separate network-privacy use, the offers below are commercial placements selected by the site’s existing settings. They do not fix the Firefox vulnerabilities or establish a security ranking. Check the full payment, renewal terms and device support before subscribing.

For platform-specific choices, see our Windows VPN guide. For account-sensitive browsing, our online banking and VPN guide explains why authentication and genuine websites remain separate responsibilities.

An interesting detail in Mozilla’s advisory

Mozilla says it has changed its advisory approach: internally identified memory-safety vulnerabilities now receive individual CVE entries rather than being rolled into a single CVE. A longer list therefore should not automatically be read as proof that this release is uniquely dangerous. Compare the issue descriptions, affected versions and stated impact instead of judging urgency solely by a count.

For readers, this illustrates a broader reporting problem. A count can reflect how findings are grouped as well as how much software changed. This article therefore does not turn the advisory into a league table of browsers, claim that every listed bug applies identically to every operating system, or infer active exploitation from the existence of a fix.

A useful check before you carry on browsing

1. Identify the Firefox edition and installation route you actually use.
2. Apply the update through that route, saving unfinished work before restarting.
3. Reopen the browser and confirm its displayed version or ask your administrator to confirm the managed update.
4. Check essential browsing and VPN functions without weakening security settings.
5. Keep account authentication and website checks in place; a browser update and VPN do not replace them.

The practical outcome is straightforward: complete the relevant Firefox update, then continue your normal privacy checks. This is analysis of Mozilla’s dated release and documentation, not an independent penetration test or a claim that an individual device is safe after one action. Release availability, installed versions and managed deployment can differ, so use the evidence visible on your own device.