Firefox 157.0.1 security update: file-handling fix, install today

If you already jumped to Firefox 157 last week, you are not done. On October 6, 2026, Mozilla shipped Firefox 157.0.1 on the Release channel with a security advisory and a short list of everyday fixes.

This is a follow-up to our Firefox 157.0 / Nova note. Same major version train. Newer build. New security fix. Check about:support again.

What Mozilla shipped

Mozilla’s Firefox 157.0.1 release notes (first offered October 6, 2026) list:

A fix for downloads failing on macOS when Firefox asks where to save files but does not have permission to access the Downloads folder
A fix for the sidebar getting stuck on the Bookmarks or AI Chatbot panel for some users
A fix for the Restore from Backup option not appearing during onboarding on Windows
A security fix

The security details are in MFSA 2026-104 (announced October 6, 2026, impact moderate):

CVE-2026-106016: mitigation bypass in the File Handling component
Reporter: Abdulrahman Alzahrani
Fixed in Firefox 157.0.1

You do not need a deep dive into file-handling internals. If about:support still shows plain 157.0, move to 157.0.1.

Why .0 is not enough anymore

Firefox 157.0 already carried a large September 29 security advisory. That install still matters. It does not include this October 6 File Handling fix.

Same habit every time:

Update
Fully quit and relaunch
Prove it with about:support

Downloaded is not running. The version line is the receipt.

How to update and verify on your computer

Open Firefox on the computer you actually browse with.
Check for updates.
- Windows / Linux: Menu (three lines) → Help → About Firefox.
- macOS: Firefox menu → About Firefox.
Stay on the About window until the download finishes. Firefox often says it is downloading or ready to restart.
Restart to update when prompted. Do not click Later and keep working in old windows.
Fully quit if the version still looks old. Close every Firefox window. On Windows, confirm in Task Manager that no firefox.exe helpers are left. On Mac, use Firefox → Quit Firefox. Then open Firefox again.
Verify with about:support. Type that into the address bar. On the Application Basics block, read Version. You want 157.0.1.
Repeat on other home computers that still run Firefox, including a laptop that stays open for days and any shared family machine.

If About Firefox says an update is coming but will not offer 157.0.1 yet, wait for your Release roll to reach you, then force the check again. Prefer Mozilla’s own download links if a stuck profile update loop refuses to move.

Everyday fixes worth knowing

After you are patched, the non-security items in the 157.0.1 notes may explain annoyances you hit this week:

macOS download save dialogs failing when Downloads folder permission is missing
Sidebar stuck on Bookmarks or AI Chatbot
Windows onboarding missing Restore from Backup

None of those replace the security update. They are bonus reasons to leave 157.0 behind.

Do this / don’t do that

Force About Firefox, relaunch, and confirm about:support shows 157.0.1.
Treat MFSA 2026-104 as a patch signal, not a reading assignment.
If you run ESR on purpose, watch Mozilla’s ESR advisories separately. This article is for normal Release-channel home users.

Don’t

Do not assume a Windows reboot alone applied 157.0.1 if about:support still shows 157.0.
Do not leave old Firefox windows or background helpers running after an update prompt.
Do not invent or chase exploit details for the File Handling mitigation bypass. Patching is the job.
Do not assume updating Firefox also updated Chrome, Edge, Brave, or Safari.

Bottom line

Firefox 157.0.1 hit Release on October 6, 2026 with MFSA 2026-104 (CVE-2026-106016, File Handling mitigation bypass, moderate) plus a few everyday fixes (release notes). This is beyond the earlier Firefox 157.0 package. On your home PC or Mac: open About Firefox, install, fully quit and relaunch, then confirm about:support shows 157.0.1. That is the whole job.

Image: Official Firefox logo art on the firefox.com Open Graph background.