Firefox 158 patches 51 vulnerabilities, a third of them high-impact
Mozilla has also stopped bundling internally found memory-safety bugs into one catch-all CVE, so this release shows each flaw as its own advisory entry.
Mozilla released Firefox 158 on 13 October, with a security advisory covering 51 fixed vulnerabilities: 33 rated high, 17 moderate, and 1 low. Among the high-impact bugs are CVE-2026-109704, a privilege escalation in the Application Update component, and CVE-2026-109705, a sandbox escape caused by a site-isolation boundary error combined with a use-after-free in networking code.
The advisory itself marks a change in how Mozilla discloses these bugs. Previous releases grouped most internally found memory-safety issues into a single “memory safety bugs” CVE; this one lists each as its own entry with its own component, reporter and Bugzilla reference. Mozilla’s advisory doesn’t flag any of the 51 as under active exploitation.
Why it matters: update Firefox and Firefox ESR now rather than waiting for the next scheduled check, given the sandbox-escape bug is exactly the kind of flaw that turns a malicious page into something worse. The disclosure change also means vulnerability counts on future Firefox releases will look larger than before for the same underlying volume of bugs, worth remembering before comparing release-to-release totals.