Firefox 158 (MFSA 2026-106, 13 Oct): 77 per-bug CVEs, 30 rated high, including networking and graphics sandbox escapes and JIT bugs; ESR 153.5, ESR 115.43 and Thunderbird 158 also patched
Mozilla released Firefox 158 on 13 October 2026 with advisory MFSA 2026-106, which lists 77 CVEs: 30 rated high, 33 moderate and 14 low. Mozilla now issues a separate CVE for every internally found memory safety bug instead of rolling them into one, which is why the count is large. High-rated issues include a privilege escalation in the Application Update component (CVE-2026-109704), several sandbox escapes in the Networking component (CVE-2026-109705, CVE-2026-109707, CVE-2026-109708), a sandbox escape through uninitialised memory in Graphics (CVE-2026-109712), a sandbox information disclosure and privilege escalation (CVE-2026-109709), and many use-after-free bugs across IndexedDB, DOM, SVG, XML, canvas and media code. Amy Burnett of OpenAI reported ten of the high-rated bugs, mostly JavaScript engine and JIT boundary and miscompilation issues (for example CVE-2026-109715, CVE-2026-109720 and CVE-2026-109722). The advisory does not say any are exploited in the wild. The same day Mozilla published fixes for Firefox ESR 153.5 (MFSA 2026-108), Firefox ESR 115.43 (MFSA 2026-107), Thunderbird 158 (MFSA 2026-109) and Thunderbird 153.5 (MFSA 2026-110). Primary: Mozilla security advisories.
- Product
- Mozilla Firefox, Firefox ESR and Thunderbird
- Versions
- Fixed: Firefox 158, Firefox ESR 153.5, Firefox ESR 115.43, Thunderbird 158 and Thunderbird 153.5. Earlier releases on each channel are affected.
- Exploited in Australia?
- unknown
- Patch to
- Update to Firefox 158, or Firefox ESR 153.5 / 115.43 on extended support channels, and Thunderbird 158 or 153.5. Restart the browser or mail client so the update takes effect; managed fleets should confirm the version through their deployment tooling.
Primary: Mozilla — MFSA 2026-106 Security Vulnerabilities fixed in Firefox 158 (13 Oct 2026) · Vendor: Mozilla Foundation Security Advisories (ESR 153.5, ESR 115.43, Thunderbird 158 and 153.5) · CVE: CVE-2026-109704, CVE-2026-109705, CVE-2026-109707, CVE-2026-109708, CVE-2026-109712, CVE-2026-109709, CVE-2026-109715, CVE-2026-109720, CVE-2026-109722 · Mozilla — MFSA 2026-108 Security Vulnerabilities fixed in Firefox ESR 153.5 (13 Oct 2026)