Firefox 158 patches 77 security flaws, 30 of them rated high

Mozilla’s advisory for Firefox 158 lists 77 separate security flaws, and 30 of them carry a high severity rating. Another 33 are rated moderate and 14 low. The release reached the Release channel on Oct. 13, and the number is unusually large for one version because Mozilla changed how it counts.

Under the old approach, a batch of memory-safety bugs found inside the company would be bundled into one catch-all entry. The new advisory breaks them out, so the 77 figure describes a more granular ledger as much as a dirtier release.

77 CVEs and a new way of counting them

Mozilla’s own advisory, MFSA 2026-106, rates the overall impact high and spells out the policy shift in plain terms. The advisory states that Mozilla has changed how it publishes advisories, and that it no longer rolls “all internally identified memory safety vulnerabilities into a single CVE” and is “now issuing an advisory for every individual bug.” The high-severity entries run from CVE-2026-109704 through CVE-2026-109733, the moderate ones from CVE-2026-109734 onward, and the low ones end at CVE-2026-109781.

The practical consequence is that year-over-year comparisons get shaky. A release with 77 entries cannot be read as more dangerous than an earlier release with far fewer, because the earlier one may have folded many internally found bugs into a single line. Mozilla’s wording makes that the explicit reason for the change. Ivanti’s October roundup puts Mozilla’s total for the month at 79 unique CVEs, a figure that appears to span more than one product line, so it does not match the Firefox 158 count exactly.

The high-rated bugs worth reading closely

Several of the 30 high-severity fixes are the kind that matter beyond a single crash. CVE-2026-109705 is a sandbox escape stemming from a use-after-free in the Networking component, reported by Mozilla’s own staff. CVE-2026-109704 is a privilege escalation in Application Update, credited to a researcher who goes by Noel, and CVE-2026-109709 covers information disclosure and privilege escalation in Process Sandboxing, credited to Yaqoub Aldurayhim.

The graphics and JavaScript engines account for much of the rest. Shu Takahashi of Velcore Consulting Inc. reported a race condition and use-after-free in the CanvasWebGL graphics code, CVE-2026-109719, and Tomer Fichman reported a use-after-free in the JIT compiler, CVE-2026-109729. PCWorld, summarizing the advisory, counts 24 use-after-free flaws among the 77 and eight that could let an attacker escape the browser sandbox. A sandbox escape is the step that turns a compromised web page into access to the rest of the machine, which is why those entries draw attention.

The moderate and low tiers are not filler. CVE-2026-109734 is a mitigation bypass in DOM Security reported by Mirko Brodesser, CVE-2026-109739 is a privilege escalation in WebExtensions reported by Tomoya Nakanishi, and CVE-2026-109750, reported by a researcher using the name cl0und, is a site isolation issue in Web Authentication. At the bottom of the list, CVE-2026-109768 is a denial-of-service bug in Site Reports found by Mozilla itself. Reading the whole advisory shows how widely the fixes are scattered across the browser rather than concentrated in one engine.

An OpenAI researcher’s nine credits

The advisory credits one reporter far more often than any other external name. Amy Burnett of OpenAI is listed against nine of the high-severity CVEs: CVE-2026-109715, -109716, -109720, -109721, -109722, -109723, -109728, -109731 and -109733, spread across the JavaScript engine, graphics and DOM components. PCWorld’s coverage says 37 of the 77 flaws came from external researchers, which puts Burnett’s nine at roughly a quarter of that group.

The same researcher turns up in the parallel advisory for the long-term-support build. MFSA 2026-107, covering Firefox ESR 115.43, credits Burnett with five of its 17 fixes. Mozilla does not say in either advisory how Burnett located the bugs, so the method stays unknown.

What else shipped and how to get it

Firefox 158 is more than a security release. Mozilla’s release notes list JPEG XL image support, more accessible PDFs saved or printed on Linux and macOS, a library for custom New Tab wallpapers, smoother scrolling that no longer rounds positions to whole screen pixels, and Smart Window form suggestions that are rolling out gradually. The notes themselves describe the security content only as “various security fixes” and point to the advisory.

The extended-support builds moved in the same cycle. PCWorld reports that Firefox ESR 153.5.0 carries 61 fixes and ESR 115.43.0 carries 17, that the 115 line supports only Windows 7 and 8.1 and macOS 10.12 through 10.14 and stays available until March 2027, and that ESR 140 received its final update on Sept. 29. Organizations still running those older operating systems have little choice about which branch to stay on, so the ESR advisory is the one that applies to them.

Desktop users on automatic updates will normally receive version 158 without doing anything, and a manual check through the About Firefox dialog will trigger the download. PCWorld reports that the next release, Firefox 159, is scheduled for Oct. 27, 2026. The advisory publishes every CVE identifier along with its component, so anyone who wants to see exactly what was fixed can read the full list.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview