The security fix comes first
The main change is the upstream patch. Floorp's GitHub release page says version 12.21.1 includes the Firefox 159.0.1 security fix and disables Mozilla-sponsored shortcuts and sponsored tile delivery by default. The project's release pull request is more specific. It says the update prepares Floorp 12.21.1 with Firefox 159.0.1, which contains the fix for CVE-2026-120572 (Mozilla MFSA 2026-123).
Mozilla's advisory names the flaw as incorrect boundary conditions in the Layout: Block and Inline component. That component is part of the engine that works out where text and boxes go on a web page. Mozilla's security advisory index shows that MFSA 2026-123 was published November 3, 2026. The advisory lists the impact as High and gives Firefox 159.0.1 as the fixed version.
Other trackers picked it up quickly. The Vulners database lists entries from NVD, CVE, EUVD, Red Hat, Rapid7 and Tenable Nessus, and shows a CVSS 3.1 8.8 score in its record. Tenable's Nessus check for Windows says the version of Firefox installed on the remote Windows host is prior to 159.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-123 advisory.
Some limits on what is known:
- Exploitation details are not public. Mozilla's advisory gives the component, the High rating and a bug reference. It does not describe how an attack would work or say whether the flaw has been exploited.
- Mozilla's advisory names Firefox, not Floorp. Floorp's own release notes and pull request are the sources confirming that 12.21.1 carries the fix.
- Vulnerability scanners may not flag Floorp. The Nessus plugin checks for installed Mozilla Firefox. If your organization relies on scanners for browser patching, check manually whether they detect a renamed Firefox derivative.
Summary: Floorp 12.21.1 delivers Mozilla's fix for CVE-2026-120572, a High-rated layout-engine bug. That alone justifies updating.
A correction on the "Firefox ESR" description
Neowin's product listing describes Floorp as derived from Firefox, which is accurate. Its standard description also says Floorp's updates are based on Firefox ESR. That does not match this release.
Mozilla's advisory index from late October lists separate ESR fixes: MFSA 2026-120 Security Vulnerabilities fixed in Firefox ESR 153.6, alongside MFSA 2026-118 Security Vulnerabilities fixed in Firefox 159. Floorp 12.21.x is built on the 159 release line. The previous version, 12.21.0, announced that the Firefox base had moved to the 159 series, and 12.21.1 follows Firefox's 159.0.1 point release.
This affects how you track patches. Floorp's security schedule follows Firefox's regular release channel, not the slower ESR cadence. When Mozilla publishes a Firefox release-channel advisory, expect Floorp to need a matching runtime update.
Windows builds are included
The release pull request shows the runtime bump going to every supported platform. Its automated summary says the bundled runtime was updated to version 159.0.1 across all four supported platform builds. Those four builds are Linux aarch64, Linux x86_64, macOS universal, and Windows x86_64.
The GitHub releases page shows the release was released this 04 Nov 06:57. Floorp's blog post for 12.21.1 is also dated November 4, 2026.
A caution on Firefox's own release notes: Firefox 159.0.1 also fixed crashes on Windows that could occur with some antivirus or other security software installed, in some cases also leaving WebGL disabled. Floorp's release notes only cover Floorp's own changes and send readers to Mozilla for Firefox's. Floorp does not say whether that crash fix behaves the same way in its build. Don't assume it also fixes those crashes in Floorp unless you confirm it on your own machine.
Summary: Windows x86_64 users get the same runtime update as macOS and Linux users. The fact that Floorp follows Firefox's release channel, not ESR, is the useful planning detail.
Sponsored New Tab content is off by default
The second change is a privacy one. In Floorp's words, Floorp 12.21.1 includes the Firefox 159.0.1 security fix and disables Mozilla-sponsored shortcuts and sponsored tile delivery by default. The GitHub change list credits the work to a pull request titled Disable Mozilla-sponsored shortcuts and tile delivery by default by @Ryosuke-Asano in #3019.
This is a default setting. It is not a claim that every kind of sponsored or advertising content has been removed from the browser. Still, a browser that promotes privacy should not ship with sponsored tiles turned on, so the change fits the project's stated aims.
Workspace Sync: what syncs and what doesn't
Floorp 12.21.0 arrived a week earlier and introduced Workspace Sync. It sends selected workspaces, with their names, icons and regular web tabs, to other Floorp installs signed in to the same Mozilla Account. According to the 12.21.0 notes:
- You choose which workspaces to sync. Existing workspaces are not uploaded automatically.
- Private windows, local files and internal browser pages were excluded.
- Form contents, cookies and container assignments were not synced.
Version 12.21.1 fills part of that gap. Floorp's notes say:
- Workspace defaults and per-tab container assignments now sync (Floorp #2999).
- Other devices use matching local containers. A synced tab opens in the equivalent container on the receiving machine.
- Cookies and sign-in sessions stay on each device. A tab assigned to your "Work" container on one PC will land in the "Work" container on your laptop, but it will not arrive signed in. Your organization and container setup travel between devices. Your sign-in sessions do not.
- Sync resumes when you turn it back on and now shows when syncing is paused (Floorp #2995).
Keeping cookies and sessions local is the safer choice. Copying authenticated sessions between machines would create risks that security teams would object to, for good reason.
To use the feature, follow the 12.21.0 instructions. Click the workspace name in the upper right to open the list, right-click the workspace you want, and choose Sync This Workspace and Its Tabs. A status indicator marks selected workspaces and shows the reason when sync needs attention.
Summary: Workspace Sync now carries container assignments as well as tabs. Sign-in sessions still stay on each device.
Web App fixes and a reinstall step
Two fixes affect Floorp's Web Apps feature:
- Container labels: Floorp fixed the container labels shown for Web Apps (Floorp #2998).
- Japanese input on macOS: In experimental macOS Web Apps, new text now appears after you cancel conversion with Escape or delete all marked text (Floorp #3002). Updating the browser alone does not apply this fix. You must reinstall each existing Web App after updating Floorp.
Windows users only need the first fix. The input fix applies to experimental macOS Web Apps. The release also includes updated translations.
What to do now
- Update Floorp to 12.21.1 on every machine where it is installed. Floorp's release posts point to the official download page and GitHub Releases as distribution channels.
- Check the runtime version. It should report the Firefox 159.0.1 base. Anything earlier is still on the pre-patch runtime.
- Confirm your scanners can see Floorp. If your vulnerability management depends on Firefox-specific detection rules, Floorp installs may not be checked at all.
- Reinstall macOS Web Apps if you rely on the Japanese input fix.
- Review Workspace Sync settings if you use containers. Assignments now sync, so make sure matching containers exist on each device.
The bottom line
Floorp turned around the Firefox 159.0.1 security patch about a day after Mozilla published its advisory. For a small Firefox derivative, that matters. Some forks fall behind their upstream engine and quietly leave users exposed.
The broader point applies to every Firefox-based browser. Its security depends on how quickly the maintainers ship Mozilla's fixes. In this case, Floorp shipped the 159.0.1 fix quickly, also turned off sponsored New Tab content, and improved Workspace Sync.