Firefox 158 fixes sandbox flaws: update, restart and verify

Mozilla has released Firefox 158 with a substantial set of security fixes. The 13 October MFSA 2026-106 advisory carries an overall high impact rating and lists 30 individually identified high-severity vulnerabilities. They include flaws that may enable sandbox escape, privilege escalation or unsafe memory use.

The practical message for an individual is straightforward: let Firefox retrieve the update, restart the browser and verify that version 158 is running. In an organisation, delivering a package to endpoints is not enough—the process owner should confirm that users have actually started the corrected version.

Breachroad’s conclusion: a browser is one of the main interfaces to untrusted websites, documents and advertising content. A large update does not automatically mean that an attack campaign is under way, but it does justify a short deployment window and a clear message to employees.

What Mozilla fixed

The high-severity issues include:

• CVE-2026-109704, a privilege-escalation flaw in the Application Update component;
• CVE-2026-109705, 109707, 109708 and 109712, covering several sandbox-escape paths;
• CVE-2026-109709, involving information disclosure and privilege escalation in process sandboxing;
• multiple use-after-free flaws across IndexedDB, graphics, Canvas2D, DOM, XML and other components;
• boundary-condition and JIT miscompilation issues in the JavaScript and WebAssembly engines.

The advisory also contains moderate- and low-severity vulnerabilities. Mozilla notes a change in publication method: internally identified memory-safety bugs are no longer rolled into one CVE and now receive individual identifiers. The number of entries therefore should not be compared mechanically with earlier releases without accounting for this change.

The public advisory does not report active exploitation of these vulnerabilities. Nor does it describe a single attack chain connecting every CVE. That distinction matters: the fixes deserve prompt action, but an employee notice should not turn missing evidence into a claim of confirmed compromise.

What an individual should do

Open the Firefox menu, choose Help, then About Firefox. The browser will check for an update and show the version currently running. Restart the application after the download. On an employer-managed computer, follow the organisation’s instructions and report a missing update to the help desk instead of looking for an installer on an unfamiliar website.

Save form entries and work in web applications before restarting. Restoring tabs does not always restore unsaved text or every session state. Obtain the update through the built-in mechanism, an approved store or the operating system’s package repository. A link in an unexpected advert or message is not a safe shortcut.

If Firefox still reports a release earlier than 158 after a restart, an enterprise policy, another release channel or an operating-system vendor package may be involved. Report the version, operating system and error shown. Do not disable endpoint controls yourself.

Check Firefox ESR separately

Organisations on an Extended Support Release channel should not expect to see 158 on every endpoint. Mozilla published separate advisories for Firefox ESR 153.5 and Firefox ESR 115.43. Administrators need to match each device to the branch it actually uses and verify the appropriate corrected release.

A useful deployment report distinguishes:

• endpoints running regular Firefox 158;
• endpoints on a corrected ESR release;
• installations supplied by a Linux distribution or system store;
• devices waiting for a restart;
• compatibility exceptions with an owner and review date.

“Package delivered” is not the same as “fixed version running”. Endpoint-management telemetry should report the active version, while a sample of workstations can confirm that policy works beyond the dashboard.

Communicate the update without causing alarm

A short employee message could read: “Firefox has received important security fixes. Save your work, restart the browser by the end of the day and confirm the version in About Firefox. Contact the help desk if the update does not appear.”

That message gives an action, deadline and support route. It does not require the reader to understand use-after-free conditions or sandbox architecture. At the same time, it helps counter a common scam technique: a fake “urgent update” prompt displayed by a website.

Administrators should track compliance by release channel, organisational unit and last endpoint check-in. Powered-off computers, employees away from the office and devices with a compatibility hold need a visible exception queue rather than disappearing inside an average percentage.

The organisational lesson

A browser update is a joint process between people and technology. IT delivers the fix, the user completes the restart, the help desk resolves exceptions and the security owner verifies the outcome. If one part is missing, the report may look healthy while an outdated process is still running on some devices.

The vulnerability details, severity ratings and corrected channels are facts from Mozilla’s advisories. The communication model, status breakdown and exception controls are Breachroad recommendations. Teams can practise these everyday decisions in our cybersecurity training for organisations, while our vulnerability management guide covers deployment priorities in more detail.