Mozilla released Firefox 158 on Oct. 13, patching 77 individually disclosed security vulnerabilities. Thirty carry a high-severity rating, 33 are moderate, and 14 are low.
The high-severity entries include flaws in the systems meant to keep a web page's code confined: process sandboxing, site isolation, and privilege controls. Alongside them are memory-safety bugs affecting the JavaScript engine, JIT compiler, graphics code, and other browser components.
Mozilla also changed how it reports internally identified memory-safety bugs. Instead of combining them into a single CVE, the company now publishes individual entries for each vulnerability, according to Mozilla's security advisory. That makes the number of disclosed vulnerabilities harder to compare directly with older releases.
Firefox 158 contains the fixes described in the advisory. Mozilla does not identify any of the listed vulnerabilities as actively exploited, although that does not rule out undisclosed exploitation.
The scope of the Firefox 158 security update
The 77 vulnerabilities affect numerous browser components, including networking, process sandboxing, the JavaScript engine, graphics, the DOM, storage, crash reporting, and application updates.
Several of the high-severity vulnerabilities involve systems designed to contain potentially malicious web content. Others affect lower-level browser components responsible for executing JavaScript, processing documents, and rendering pages.
One entry is CVE-2026-109704, a high-severity privilege escalation flaw in the Application Update component. It is separate from the sandbox and memory-safety vulnerabilities but belongs to the same set of Firefox 158 security fixes.
The update also includes vulnerabilities in WebExtensions and enterprise policies. These affect different browser mechanisms and should not be treated as a single exploit chain.
Firefox 158 sandbox escapes and site-isolation flaws
Three types of vulnerabilities appear repeatedly in this part of the advisory.
A sandbox escape allows code to operate outside the restrictions of its assigned process. A site-isolation flaw weakens boundaries separating web content from different sites. A privilege escalation flaw allows a process or component to perform actions beyond its intended permissions.
These weaknesses can overlap, but they describe different security failures.
CVE-2026-109705 combines several of them. Mozilla classifies the Networking vulnerability as high severity and describes a sandbox escape, site-isolation issue, incorrect boundary conditions, and use-after-free.
CVE-2026-109709, also high severity, involves information disclosure and privilege escalation in the Security: Process Sandboxing component.
Other high-severity sandbox escapes include CVE-2026-109707, a use-after-free in Networking; CVE-2026-109708, an incorrect-boundary-conditions flaw in Networking; and CVE-2026-109712, which involves uninitialized memory in Graphics.
Several moderate-severity vulnerabilities affect similar protections:
- CVE-2026-109740: Sandbox escape in Widget: Win32.
- CVE-2026-109745: Sandbox escape involving uninitialized memory in DOM: Web Serial.
- CVE-2026-109755: Sandbox escape in DOM: Content Processes.
- CVE-2026-109757: Race-condition sandbox escape in Networking.
- CVE-2026-109750 and CVE-2026-109759: Site-isolation issues in Web Authentication and Networking, respectively.
The update also fixes moderate-severity privilege escalation vulnerabilities in WebExtensions, CVE-2026-109739, and DOM: Navigation, CVE-2026-109756. A separate WebExtensions privilege escalation issue, CVE-2026-109778, carries a low-severity rating.
These entries span multiple browser security boundaries rather than one isolated component. Organizations managing browser threats across enterprise networks should include Firefox patch status in their endpoint assessments.
Memory-safety and JIT flaws in Firefox 158
Use-after-free vulnerabilities occur when software continues accessing memory after it has been released. Incorrect boundary conditions can allow operations outside intended limits.
Firefox 158 fixes numerous high-severity vulnerabilities involving these problems across DOM bindings, SVG rendering, audio and video playback, canvas graphics, layout, XML, and streams.
Examples include CVE-2026-109717 in DOM: Bindings, CVE-2026-109718 in XML, CVE-2026-109724 and CVE-2026-109725 in DOM: Core & HTML, CVE-2026-109726 in SVG, CVE-2026-109727 in Audio/Video, and CVE-2026-109732 in DOM: Streams.
Several high-severity bugs affect the JavaScript engine and its just-in-time compilation components.
CVE-2026-109720 involves JIT miscompilation in WebAssembly. CVE-2026-109722 and CVE-2026-109733 are JIT miscompilation vulnerabilities in the JavaScript engine. CVE-2026-109721 concerns incorrect boundary conditions, while CVE-2026-109729 involves use-after-free in the same JIT component.
Moderate-severity vulnerabilities include mitigation bypasses in DOM: Security, CVE-2026-109734, and Enterprise Policies, CVE-2026-109737.
Mozilla lists these issues separately from the sandbox vulnerabilities. The advisory does not establish that attackers have combined them into working exploit chains.
What administrators should do next
Users running earlier Firefox releases should update to Firefox 158. Mozilla's update instructions explain how to check the installed version through the browser's Help menu and install the latest release.
Enterprise administrators should confirm that updates have reached managed endpoints, including devices that require a browser restart before patches take effect.
Organizations using Firefox Extended Support Release should verify their installed ESR version against the applicable Mozilla advisory instead of assuming that Firefox 158 is the appropriate update. Mozilla's enterprise release documentation identifies Firefox ESR 153.5 as the corresponding October release.
Centralized patch management tools can help administrators track deployment and identify devices that remain on vulnerable versions.
The 77-CVE total also requires context. Mozilla's new disclosure approach assigns separate CVEs to internally identified memory-safety bugs that previously could have been grouped together. Higher reported counts do not automatically mean that Firefox has become less secure.
For IT teams, the immediate priority is to install the applicable security update and verify that it is running across managed devices.
Also read: Google's recent Chrome 155 security update addressed 247 vulnerabilities, including four critical flaws.