Firefox 157 is out: big security advisory plus the Nova look

If Firefox is your daily browser on a Windows, Mac, or Linux computer at home, update it today. Firefox 157.0 hit the Release channel on September 29, 2026. The feature notes are nice. The security advisory is the reason to stop reading and click About Firefox.

Mozilla published Security Vulnerabilities fixed in Firefox 157 (MFSA 2026-97) the same day. That advisory lists 76 individual CVE entries under Mozilla’s newer “one advisory per bug” style. Impact is rated high overall. The list includes sandbox escapes, use-after-free bugs, privilege escalation, WebGPU and WebAssembly issues, and more. You do not need exploit details. You need 157.0 running.

Product changes are in the Firefox 157.0 release notes. This follows our earlier Firefox 156 release note. Same habit: update, fully quit, relaunch, prove it with about:support.

Security first (skip the CVE scavenger hunt)

Mozilla’s advisory for Firefox 157 is large. Many items are High. Several describe sandbox escapes or use-after-free bugs in graphics, DOM, WebAssembly, and related components. Mozilla also changed how it publishes advisories: it no longer rolls a pile of memory-safety bugs into one catch-all CVE. That is why the page looks longer than older Firefox security notes.

Treat the advisory as a patch signal, not a reading assignment. Do not hunt for proof-of-concept writeups. Do not wait for a scary headline. Install 157.0, fully quit Firefox, relaunch, and confirm the version.

If you are on an ESR train instead of Release, matching same-day ESR packages are 153.4, 140.17, and 115.42 (see Mozilla’s ESR advisories linked from the September 29 security set, including MFSA 2026-100 for ESR 153.4). Most home users on the normal Release channel want 157.0, not ESR.

What Nova and friends change for a home user

From Mozilla’s 157.0 notes, the noticeable product changes are:

Nova visual refresh. A modernized look across toolbars, sidebar, menus, and related UI, built on Mozilla’s updated design system. New built-in themes include light and dark versions. There is also a compact mode that tightens toolbar and tab spacing for smaller screens and split layouts.
Encryption-key-recording warning. Firefox can warn in the site information panel (the shield icon in the address bar) and in Settings when it has been set up to record its encryption keys. That setup can let other software on the computer read encrypted web traffic. If you ever see that warning at home, treat it as a stop-and-investigate signal. It is not a normal everyday toggle.
Firefox Suggest expansion. Address-bar suggestions expand to more countries in Europe (Austria, Belgium, Czech Republic, Denmark, Finland, Hungary, Ireland, Luxembourg, Netherlands, Norway, Poland, Portugal, Slovakia, Spain, Sweden, and Switzerland). Control them in Firefox Suggest settings if they feel noisy.
Everyday fixes. WebRTC camera orientation, address-bar suggestion selection while a page is still loading, dull HDR video on Windows, A/V sync when changing playback speed, Vertical Tabs in full screen, and a Windows full-screen taskbar overlay bug.

There are also smaller behavior changes (Tab focus in the address/search bars, Amazon removed as a built-in search engine, sidebar revamp on for everyone, dialogs matching page light/dark scheme). Read Mozilla’s page if something you hit last month sounds familiar. None of that replaces the security update.

If the new sidebar look is too much, Mozilla still documents restoring the previous sidebar with sidebar.revamp set to false in about:config until the end of 2027. That also turns off vertical tabs. Optional. Security update first.

Update Firefox on your computer

Open Firefox on the computer you actually browse with.
Check for updates.
- Windows / Linux: Menu (three lines) → Help → About Firefox.
- macOS: Firefox menu → About Firefox.
Stay on the About window until the download finishes. Firefox often says it is downloading or ready to restart.
Restart to update when prompted. Do not click Later and keep working in old windows.
Fully quit if the version still looks old. Close every Firefox window. On Windows, confirm in Task Manager that no firefox.exe helpers are left. On Mac, use Firefox → Quit Firefox. Then open Firefox again.
Verify with about:support. Type that into the address bar. On the Application Basics block, read Version. You want 157.0 (or a 157.0.x dot release if Mozilla ships one soon after).
Repeat on other home computers that still run Firefox, including a laptop that stays open for days and any shared family machine.

If About Firefox says an update is coming but will not offer 157 yet, wait for your Release roll to reach you, then force the check again. You can also download a fresh installer from Mozilla’s own site if a stuck profile update loop refuses to move. Prefer Mozilla’s download links over random “offline installer” pages.

Do this / don’t do that

Force About Firefox, relaunch, and confirm about:support shows 157.0.
If you run ESR on purpose, move to 153.4, 140.17, or 115.42 as applicable.
Skim the Nova themes and compact mode after you are patched. Personalize later.
If the encryption-key-recording warning appears, find out what software asked Firefox to record keys before you ignore it.

Don’t

Do not assume a Windows reboot alone applied Firefox 157 if about:support still shows 156.x or earlier.
Do not leave old Firefox windows or background helpers running after an update prompt.
Do not invent or chase exploit details for the High sandbox-escape items. Patching is the job.
Do not assume updating Firefox also updated Chrome, Edge, Brave, or Safari.

Bottom line

Firefox 157.0 hit Release on September 29, 2026 with a large security advisory (76 CVEs in MFSA 2026-97, impact high) plus the Nova visual refresh, an encryption-key-recording warning, Suggest expansion, and assorted fixes (release notes). On your home PC or Mac: open About Firefox, install, fully quit and relaunch, then confirm about:support shows 157.0. That is the whole job.

Image: Firefox marketing / Open Graph art (firefox.com).