Summary
- Mozilla published Firefox 158 security advisory MFSA 2026-106 on 13 October.
- High-impact issues include sandbox escapes and privilege escalation.
- The advisory does not by itself establish exploitation in the wild.
Mozilla has released Firefox 158 with security corrections covering several high-impact vulnerabilities, including weaknesses described as sandbox escapes, privilege escalation and memory safety faults. The release and accompanying advisory were published on 13 October, creating a new update requirement for organisations that allow Firefox on managed endpoints.
The advisory lists CVE-2026-109704 as privilege escalation in the Application Update component. Other high-impact findings include CVE-2026-109705, described as a sandbox escape and site isolation issue involving incorrect boundary conditions and a use-after-free in networking, and CVE-2026-109707 and CVE-2026-109708, also associated with sandbox escape paths. Mozilla separately identifies an information disclosure and privilege escalation issue in process sandboxing under CVE-2026-109709.
A browser sandbox aims to restrict what web content and individual browser processes can access if another vulnerability is triggered. A weakness in those boundaries can alter the consequences of a compromise because a successful attacker may gain reach beyond the process originally handling untrusted content. The presence of several sandbox-related corrections in one advisory warrants careful attention, although their technical prerequisites and exploitability are not identical.
Mozilla also documents use-after-free issues in IndexedDB, graphics text and Canvas2D components. Such flaws arise when software continues to use memory after it has been released. Their consequences depend on how the affected code can be reached and which protections apply. A severity designation therefore indicates possible impact under relevant conditions, not proof that attacks have been observed.
The release adds to the security workload for organisations deploying browsers through enterprise endpoint management. Organisations may maintain separate update channels for standard Firefox and Extended Support Release editions, while some departments depend on browser extensions, identity controls or web applications that require compatibility validation. A managed deployment can consequently lag a public consumer release even when the underlying security correction is available.
Mozilla has also changed its approach to publishing advisories. Rather than combine all internally identified memory safety vulnerabilities into a single CVE, it says it is issuing an advisory for every individual bug. This produces greater granularity for vulnerability inventories and automated scanners, but it means comparisons of the raw number of reported issues across releases require caution.
Mozilla’s shift to individual CVEs increases the number of distinct records available to vulnerability management tools. A scan may now generate several separate records for different components corrected by the same browser release, while earlier versions may have grouped memory safety findings under a smaller number of identifiers. Counting entries alone can therefore exaggerate changes in the number of underlying weaknesses. Organisations still need to correlate those records with the one product update that addresses them. Browser security has particular operational consequences because the affected software processes content supplied by many unrelated websites, web applications and documents.
Some browser exploits may be restricted by isolation boundaries, permissions or operating-system protections, but failures in those boundaries can make chains of weaknesses more concerning. The October advisory names the fault classes without publishing an exploit recipe for each one. Mozilla’s separate ESR releases also require administrators to confirm the appropriate fixed build rather than installing the standard-channel number on machines using a supported long-term version. The appropriate deployment sequence depends on the release channel, the affected builds and the operational consequences of the individual fixes. Mozilla’s advisory does not provide a quantified victim count or identify an active campaign involving these vulnerabilities.
The current advisory identifies affected classes of flaws and links to the relevant bug reports. It does not state that each vulnerability has been exploited in active campaigns. Firefox 158 is available through Mozilla’s release channel, and organisations should match the fixed version against their deployment policies while checking the separate security notices for supported ESR channels.
