Firefox 160 security update: which release should you install?

Firefox 160 arrived on November 10, 2026, alongside security updates for two Extended Support Release branches. Mozilla lists Firefox 160, Firefox ESR 153.7 and Firefox ESR 115.45 as the fixed versions in three advisories announced that day. The practical question is which release line a particular installation uses, rather than whether every Firefox user should install the same numbered package.

This is a current release-and-update guide, separate from our historical explanation of the 271 AI-found Firefox bugs. That April finding count does not describe today's fixes or the update that a computer needs now.

Match the advisory to the installed branch

Mozilla's Firefox 160 advisory identifies the regular browser release. Its entries include security-boundary problems, sandbox escapes, privilege escalation and use-after-free defects in components including graphics, navigation and networking. The advisory's overall impact is high; that label is a vendor assessment, not a measurement of attacks against this article's readers.

The ESR 153.7 advisory also carries a high overall impact rating. Several listed identifiers overlap with the regular release, including CVE-2026-124853 in graphics/text and CVE-2026-124856 in HTTP networking. Shared identifiers do not make the two release packages interchangeable.

The ESR 115.45 advisory names the older ESR line explicitly. Its listed fixes include CVE-2026-109736, described as frame poisoning in layout, as well as defects shared with the other advisories. Someone checking that branch should use its own fixed-version statement, rather than infer applicability from the largest version number on a news page.

These are three vendor-listed release lines, not three successive installation steps. Recording the product, installed version and applicable advisory together avoids combining a valid vulnerability identifier with an unrelated package.

What changed beyond the security fixes

The Firefox 160 release notes date its first release-channel offering to November 10. They describe Picture-in-Picture playback-speed controls from 0.25x to 2x, visible in a medium-sized or larger player window. They also introduce Mini Window, which places a tab or selected page area in an always-on-top window; Mozilla calls this an early version and requests feedback.

Those interface additions help distinguish a feature announcement from a security advisory. They do not establish that ESR has adopted the same interface changes, or demonstrate performance on a particular machine. We have not benchmarked or tested these releases. The security reason to update stands independently of whether a reader wants a new window feature.

Check the update route before changing anything

Mozilla's update instructions explain that the About Firefox window checks for updates and downloads an available update. A restart applies it. On Windows the documented route starts in the menu and Help; on macOS, use the Firefox menu and About Firefox. Reopen the version information after restarting to check what is actually installed.

The same support page separates installations obtained from Mozilla from those managed elsewhere. Linux distribution packages receive updates through the distribution's software mechanism; Microsoft Store installations use the Store. A managed computer may require its administrator's established process. Do not mistake the absence of Mozilla's in-browser update control for evidence that a security fix does not exist.

Keep the evidence and the conclusion separate

A useful completion record contains four items: the installed release line, its relevant fixed version, the source of the package and the version observed after restart. A download notification answers only part of that checklist. It does not, by itself, establish that the running browser has changed.

The advisories establish fixes and branch-specific version references. This article does not establish active exploitation, compromise of any device or absence of risk after updating. It also does not turn each listed defect into a confirmed zero-day. Those would require different evidence.

For a reader comparing headlines, the distinction is useful: an earlier discovery tally, a new release number and successful local installation are three separate facts. Today's actionable step is to check the applicable update channel and confirm its result, using the current vendor documents rather than an old vulnerability-count headline.