Firefox 158 security update: install today on your home PC

If Firefox is the browser you actually use at home, check the version today. On October 13, 2026, Mozilla shipped Firefox 158.0 on the Release channel with a large security advisory.

This is a new major train, not another 157.x bump. Our recent Firefox 157.0.1 note still mattered last week. It is not today’s target.

What Mozilla shipped

Mozilla’s Firefox 158.0 release notes say version 158.0 was first offered to Release channel users on October 13, 2026. The notes include everyday changes (faster form fill in Smart Window for some users, more accessible PDF saving, JPEG XL support, a few translation languages, smoother scrolling) and various security fixes.

The security details are in MFSA 2026-106 (announced October 13, 2026, impact high), fixed in Firefox 158.

You do not need a CVE scavenger hunt. Mozilla rates this advisory high and lists many fixed bugs, including sandbox escapes, privilege escalations, and use-after-free issues across networking, graphics, and the JavaScript engine. A few named themes from that advisory:

• Privilege escalation in Application Update (CVE-2026-109704)
• Sandbox escape / site isolation / use-after-free issues in Networking (CVE-2026-109705, CVE-2026-109707, CVE-2026-109708, and related entries)
• Use-after-free bugs in IndexedDB, graphics, DOM, SVG, audio/video, and related components
• Additional moderate and low issues across PDF Viewer, WebExtensions, WebAuthn, and other areas

If about:support still shows 157.0.1 or any earlier 157.x build, move to 158.0.

Mozilla also published matching ESR security advisories the same day (MFSA 2026-107 for Firefox ESR 115.43, MFSA 2026-108 for Firefox ESR 153.5). This article is for normal Release-channel home users. If you intentionally run ESR, update that channel instead of chasing 158.

Why 157.x is not enough anymore

Firefox 157.0.1 closed a File Handling mitigation bypass on October 6. That install still mattered. It does not include today’s Firefox 158 security set.

Same habit every time:

1. Update
2. Fully quit and relaunch
3. Prove it with about:support

Downloaded is not running. The version line is the receipt.

How to update and verify on your computer

1. Open Firefox on the computer you actually browse with.
2. Check for updates.
   • Windows / Linux: Menu (three lines) → Help → About Firefox.
   • macOS: Firefox menu → About Firefox.
3. Stay on the About window until the download finishes. Firefox often says it is downloading or ready to restart.
4. Restart to update when prompted. Do not click Later and keep working in old windows.
5. Fully quit if the version still looks old. Close every Firefox window. On Windows, confirm in Task Manager that no firefox.exe helpers are left. On Mac, use Firefox → Quit Firefox. Then open Firefox again.
6. Verify with about:support. Type that into the address bar. On the Application Basics block, read Version. You want 158.0 (or a newer 158.0.x if Mozilla ships a point release after this article).
7. Repeat on other home computers that still run Firefox, including a laptop that stays open for days and any shared family machine.

If About Firefox says an update is coming but will not offer 158 yet, wait for your Release roll to reach you, then force the check again. Prefer Mozilla’s own download links if a stuck profile update loop refuses to move.

Phone browsers are separate

Desktop Firefox updates do not patch Firefox on iPhone or Android. Those apps update through the App Store or Google Play on their own schedules. If you browse in Firefox on a phone, check the store listing and open the app once after it updates so the new build actually launches.

Do this / don’t do that

Do

• Force About Firefox, relaunch, and confirm about:support shows 158.0.
• Treat a high-impact MFSA on a new major Release train as “install today,” not “install when I remember on Sunday.”
• Update Chrome, Edge, Brave, and Safari on their own pages if you use them. Updating Firefox does not update them.
• If you run ESR on purpose, use the ESR advisories from October 13 instead of this Release-channel target.

Don’t

• Do not stop at 157.0.1 because you already “did the Firefox update” last week.
• Do not assume a Windows reboot alone applied 158 if about:support still shows 157.x.
• Do not invent exploit details for individual CVEs. Patching is the job.
• Do not download random “Firefox offline installer” packs from third-party sites. Use Firefox’s own About page or Mozilla’s download links.

Bottom line

Firefox 158.0 hit Release on October 13, 2026 with MFSA 2026-106 (impact high) plus the everyday changes listed in the release notes. This is beyond the earlier Firefox 157.0.1 package. On your home PC or Mac: open About Firefox, install, fully quit and relaunch, then confirm about:support shows 158.0. That is the whole job.

Image: Firefox mascot Kit marketing art (firefox.com).