Skip to navigation

Threat reportVulnerabilityTL-2026-5443

Firefox for Windows Layout Out-of-Bounds Vulnerability (CVE-2026-120572) Fixed in 159.0.1

highPATCHED

Mozilla Firefox versions prior to 159.0.1 contain a memory-safety flaw (incorrect boundary conditions) in the Layout: Block and Inline component, tracked as CVE-2026-120572 and rated High by Mozilla (MFSA 2026-123). A remote attacker could entice a user to open a web page with specially crafted content; HK GovCERT reports denial of service as the impact, and the CVSS 3.1 vector (8.8) also rates confidentiality and integrity impact High.

Key facts for Firefox 159.0.1 layout flaw

IdentifiersTL-2026-5443, CVE-2026-120572
Also known asMFSA 2026-123, HK GovCERT A26-11-06
SeverityHIGH
CVSS8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
First disclosed
Exploitation statusNo known exploitation
EPSSCVE-2026-120572: 0.3% (26.1th percentile)
Affected productsMozilla Firefox (Windows)
Weaknesses (CWE)CWE-119, CWE-193
MITRE ATT&CK techniquesT1203 Exploitation for Client Execution, T1204.001 User Execution: Malicious Link, T1499.004 Endpoint Denial of Service: Application or System Exploitation
MotivationUNKNOWN
Target sectorsgovernment administration, enterprise, general-users
Target regionsGlobal
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage for Firefox 159.0.1 layout flaw

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5443 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vulnerable Firefox Build (< 159.0.1) Launched on Windows - CVE-2026-120572

Identifies firefox.exe process launches whose file version is earlier than 159.0.1, the build that fixes CVE-2026-120572 (MFSA 2026-123, Layout: Block and Inline incorrect boundary conditions, CWE-119/CWE-193). The flaw is reachable by rendering crafted web content (T1189/T1203). No exploitation in the wild is reported, so this is a patch-prioritization detection: it tells defenders which hosts are running an exposed build.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1203, T1189
  • Data sources: sysmon:EventCode=1, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, sigma:process_creation/windows
  • Severity: medium
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\firefox.exe" earliest=-24h ```CVE-2026-120572 / MFSA 2026-123 - Firefox below 159.0.1 on Windows``` | rex field=FileVersion "^(?<ff_major>\d+)\.(?<ff_minor>\d+)(?:\.(?<ff_patch>\d+))?" | where isnotnull(ff_major) | eval ff_major=tonumber(ff_major), ff_minor=tonumber(ff_minor), ff_patch=coalesce(tonumber(ff_patch),0) | where ff_major<159 OR (ff_major=159 AND ff_minor=0 AND ff_patch<1) | stats count AS launches min(_time) AS first_seen max(_time) AS last_seen values(FileVersion) AS firefox_version BY Computer, User | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "firefox.exe"
| extend FirefoxVersion = parse_version(ProcessVersionInfoProductVersion)
| where isnotnull(FirefoxVersion) and FirefoxVersion < parse_version("159.0.1")
| summarize Launches = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Versions = make_set(ProcessVersionInfoProductVersion, 5) by DeviceName, AccountName
| project DeviceName, AccountName, Versions, Launches, FirstSeen, LastSeen

Sigma

title: Vulnerable Firefox Build Below 159.0.1 Launched on Windows - CVE-2026-120572
id: a3f1c2d4-5b6e-4f70-8a91-0c2d3e4f5a61
status: experimental
description: Detects firefox.exe launches whose FileVersion is earlier than 159.0.1, the release fixing CVE-2026-120572 (MFSA 2026-123, Layout Block and Inline out-of-bounds). Patch-prioritization content; no in-the-wild exploitation is reported.
references:
  - https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/
  - https://www.govcert.gov.hk/en/alerts_detail.php?id=2161
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial-access
  - attack.t1189
  - attack.execution
  - attack.t1203
  - cve.2026.120572
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\firefox.exe'
  selection_version:
    FileVersion|re: '^(?:[0-9]{1,2}|1[0-4][0-9]|15[0-8])\.[0-9.]+$|^159\.0(?:\.0)*$'
  condition: selection_image and selection_version
falsepositives:
  - Firefox ESR builds, whose version numbers are lower than 159 but are not named in MFSA 2026-123
  - Intentionally pinned legacy browsers in isolated lab or kiosk environments
level: medium

Known false positives:

  • Firefox ESR installations report version numbers below 159 but are not listed as affected in MFSA 2026-123; confirm against the advisory before treating as vulnerable
  • Portable or lab Firefox copies that are intentionally pinned to older builds

Tuning notes: Sysmon FileVersion is empty on some builds; fall back to a software inventory feed (DeviceTvmSoftwareVulnerabilities where CveId == CVE-2026-120572) to cover hosts where the process-level version is missing. Exclude confirmed ESR hosts via a lookup. Run as a daily report rather than a real-time alert, and retire once the fleet is on 159.0.1 or later.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Repeated [indicator] Crashes on One Host - Possible CVE-2026-120572 Exploit Attempts · unlock with TL Creds
  • [indicator] Writing Executable or Script Content Outside Download and Profile Paths · unlock with TL Creds
  • Vulnerable [indicator] Opened from Mail or Office Link · unlock with TL Creds
  • [indicator] Spawning Living-off-the-Land Binary · unlock with TL Creds
  • [indicator] Writing Run or RunOnce Registry Persistence · unlock with TL Creds
  • [indicator] Loading Unsigned DLL from Temp or Public Directory · unlock with TL Creds
  • [indicator] Crash Reporter Launched - Possible CVE-2026-120572 Denial of Service · unlock with TL Creds
  • [indicator] Spawning Command Interpreter - Possible Browser Exploitation Follow-On · unlock with TL Creds

Indicators of compromise for Firefox 159.0.1 layout flaw

As of 2026-11-06, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5443.

Sample indicators (1 of 9)

  • URL: hxxps://www[.]govcert[.]gov[.]hk/en/alerts_detail.php?id=2161

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

9 indicators of compromise · unlock with TL Creds. Compare plans

How Firefox 159.0.1 layout flaw works

No exploitation in the wild is stated in any source.

Mozilla Foundation Security Advisory 2026-123, announced 2026-11-03, fixes CVE-2026-120572 in Firefox 159.0.1. The flaw is described as "incorrect boundary conditions in the Layout: Block and Inline component" and is tracked in Mozilla Bug 2079035, which is restricted and not publicly readable at the time of research. Mozilla credits itself as the reporter, and Mozilla rates the impact High.

HK GovCERT Security Alert A26-11-06 (published 2026-11-04) lists the affected product as Firefox for Windows prior to 159.0.1. It states that a remote attacker could entice a user to open a web page with specially crafted content, and that successful exploitation could cause denial of service on the affected system. The recommended action is to upgrade to Firefox 159.0.1.

The CVE record enrichment (OpenCVE, citing CISA ADP Vulnrichment) lists CVSS 3.1 base score 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with weaknesses CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-193 (off-by-one error). The NVD record was still 'Awaiting Analysis' when checked. EPSS was 0.00329 (under 1%), and OpenCVE showed no CISA KEV listing. The vector's High C/I/A ratings indicate that memory corruption beyond a crash is possible in principle, but no source documents a working exploit, a public proof-of-concept, in-the-wild exploitation, a threat actor, or any network or file indicators. The bug details are restricted, so exploit mechanics are not publicly documented.

This record should be treated as patch-prioritization intelligence rather than active-threat intelligence. The vulnerable component, Layout: Block and Inline, processes untrusted web content, so the attack surface is any page the browser renders; user interaction (visiting or opening a crafted page) is required and no privileges are needed.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Remediation for Firefox 159.0.1 layout flaw

Patches

  • Firefox 159.0.1 (MFSA 2026-123)

Immediate actions

  • Upgrade Firefox for Windows to 159.0.1 or later
  • Verify installed Firefox versions across the fleet and flag any build earlier than 159.0.1

Workarounds

  • If immediate patching is not possible, avoid loading untrusted or specially crafted web pages (vendor-neutral guidance from OpenCVE)

Longer-term hardening

  • Enforce automatic browser updates through enterprise policy
  • Track Mozilla security advisories (MFSA) in the patch-management process

Affected and fixed versions

  • Mozilla — Firefox (Windows)
    Vulnerable versions: < 159.0.1
    Fixed in: 159.0.1

Timeline of Firefox 159.0.1 layout flaw

  • CVE-2026-120572 published in the CVE/NVD record, referencing Bugzilla bug 2079035 and MFSA 2026-123; NVD status 'Awaiting Analysis'.
  • locked-ioc-8 159.0.1 released, fixing CVE-2026-120572; all earlier versions are affected.
  • locked-ioc-9 publishes MFSA 2026-123 disclosing CVE-2026-120572 (Layout: Block and Inline, incorrect boundary conditions), rated High and reported by locked-ioc-9.
  • locked-ioc-7 publishes Security Alert A26-11-06 for locked-ioc-8 on Windows prior to 159.0.1, warning of denial of service via crafted web content.
  • CVE record updated with CISA ADP Vulnrichment data: CVSS 3.1 base score 8.8, CWE-119 and CWE-193.
  • Threadlinqs review finds no source reporting in-the-wild exploitation, public PoC, threat actor, or network indicators; EPSS 0.00329 and no CISA KEV listing per OpenCVE.

Sources cited for Firefox 159.0.1 layout flaw

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats