On 13 October 2026, Mozilla released Firefox 158, Firefox ESR 153.5 and Firefox ESR 115.43. The advisories list 77 CVEs for Firefox 158, 61 for ESR 153.5 and 17 for ESR 115.43. None of the three advisories says any of these bugs is exploited.
The counts look large partly because Mozilla changed how it reports. Each advisory now carries this note: "We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug." For teams that manage Firefox fleets, the more useful detail is in a few component names: Enterprise Policies, Application Update and Process Sandboxing.
What's affected
Firefox before 158 (MFSA 2026-106): 77 CVEs, 30 rated high, 33 moderate and 14 low. Eight entries are described as sandbox escapes.
Firefox ESR before 153.5 (MFSA 2026-108): 61 CVEs, 29 high, 26 moderate and 6 low.
Firefox ESR before 115.43 (MFSA 2026-107): 17 CVEs, 16 high and 1 moderate. ESR 115 still receives fixes for Windows 7 to 8.1 and macOS 10.12 to 10.14 users.
Entries that matter most if you manage Firefox centrally:
| CVE | Component | Impact | In ESR 153.5 |
|---|---|---|---|
| CVE-2026-109704 | Application Update, privilege escalation | high | yes |
| CVE-2026-109709 | Security: Process Sandboxing, information disclosure and privilege escalation | high | yes |
| CVE-2026-109737 | Enterprise Policies, mitigation bypass | moderate | yes |
| CVE-2026-109764 | Enterprise Policies, mitigation bypass | moderate | yes |
| CVE-2026-109766 | Enterprise Policies, mitigation bypass | moderate | yes |
| CVE-2026-109740 | Widget: Win32, sandbox escape | moderate | yes |
| CVE-2026-109739 | WebExtensions, privilege escalation | moderate | no |
The advisories give one line per CVE and keep bug details restricted, so the exact policy settings involved are not public yet.
The JavaScript engine also features heavily. Amy Burnett of OpenAI is credited on nine Firefox 158 entries, most of them JIT miscompilations or boundary errors in the JavaScript and WebAssembly engines.
One bookkeeping detail is worth knowing. The File Handling bug in Bugzilla 2067465 was fixed in Firefox 157.0.1 on 6 October as CVE-2026-106016. The same bug appears in the ESR 153.5 advisory as CVE-2026-109782. If you dedupe findings by CVE ID alone, you will count it twice.
How to check if you're exposed
On managed desktops, check the installed version and channel:
# Linux
firefox --version
# macOS
/Applications/Firefox.app/Contents/MacOS/firefox --version
# Windows
(Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion
Then check whether automatic updates are allowed, or whether a policy holds the browser on a pinned version:
cat /usr/lib/firefox/distribution/policies.json 2>/dev/null | jq '.policies | {DisableAppUpdate, AppUpdatePin}'
In a running browser, about:policies shows active policies and any errors.
Don't forget headless Firefox in test infrastructure. Selenium grids and E2E images often carry a Firefox build that only changes when the image is rebuilt.
What to do now
- Update to Firefox 158, ESR 153.5 or ESR 115.43, depending on channel.
- Prioritize machines where policies enforce controls, such as blocked add-ons, disabled developer tools or restricted downloads. Three of this month's fixes are policy bypasses, so those controls were less reliable before the update.
- Check
AppUpdatePinandDisableAppUpdate. A pin set for a past compatibility issue can quietly hold a fleet below 158 or 153.5. - Rebuild test images that include Firefox, and confirm the version in the job log.
- Dedupe by Mozilla bug number where you can. With one CVE per bug, the same fix can show up under different IDs across channels.
Why it matters
Enterprise policies are often treated as a hard boundary: if the policy blocks it, users can't do it. This release is a reminder that policy enforcement is browser code with its own bugs, and it gets patched like everything else. A control is only as good as the version enforcing it.
The reporting change matters for metrics too. When one advisory goes from a handful of rolled-up memory safety CVEs to 77 individual ones, dashboards that count CVEs per release will jump. That jump reflects reporting, not a sudden drop in quality. Track time to deploy each release instead.
Try it yourself
Export the Firefox version from your device management tool and group devices by channel (release, ESR 153, ESR 115). For each group, count devices below 158, 153.5 and 115.43. Then list the policies you enforce through policies.json or Group Policy and note which ones you rely on as a security control.
Click through it at your own pace, or open it full screen.
Quick check
Why does the Firefox 158 advisory list so many more CVEs than older advisories?
Mozilla now issues a CVE for every individual bug instead of rolling internally found memory safety bugs into one CVE.
Is the Enterprise Policies bypass CVE-2026-109737 fixed in ESR 153.5?
Yes. MFSA 2026-108 lists CVE-2026-109737, CVE-2026-109764 and CVE-2026-109766.
CVE-2026-106016 and CVE-2026-109782 both show up in your findings. Are they two bugs?
No. Both refer to Bugzilla 2067465, fixed in Firefox 157.0.1 and listed again for ESR 153.5.
