Firefox 159 security update: install today's release

If Firefox is the browser you actually use at home, check the version today. On October 27, 2026, Mozilla shipped Firefox 159.0 to everyday Release users with a large security advisory.

This is a new version number, not another 158.x point update. Our recent Firefox 158.0.1 note mattered last week. It is not today’s target.

What Mozilla shipped

Mozilla’s Firefox 159.0 release notes say version 159.0 was first offered to Release channel users on October 27, 2026. The notes include everyday changes (the native macOS share picker, saved passwords in the sidebar by default, and Smart Window /watch page watches rolling out gradually to some users), a list of bug fixes, and various security fixes.

The security details are in MFSA 2026-118 (announced October 27, 2026, impact high), fixed in Firefox 159.

That advisory lists 167 fixed vulnerabilities: 108 rated high, 52 moderate, and 7 low. Mozilla also says it changed how it publishes these notes. It no longer rolls internally found memory safety bugs into a single CVE and now issues an entry for every individual bug. That is part of why the count looks so large. You do not need to read every entry. A high-impact advisory on a new Firefox version is enough reason to install.

What the advisory covers, in plain English:

• 97 use-after-free bugs, the classic memory mistake, most of them in how Firefox builds and draws web pages (DOM, layout, graphics, SVG) and in the JavaScript engine
• 13 sandbox escapes, bugs that could let a compromised web page break out of the walled-off area Firefox runs it in, across navigation, form handling, networking, storage, print preview, accessibility, and graphics code
• 8 privilege escalation bugs, in areas such as WebRTC (video calling), networking, and graphics
• A handful of same-origin policy and site isolation bugs, which are about keeping one website from reading another site’s data

If about:support still shows 158.0.1 or any earlier 158.x build, move to 159.0.

Mozilla also published matching security advisories the same day for its Extended Support Release (ESR) versions: MFSA 2026-119 for Firefox ESR 115.44 and MFSA 2026-120 for Firefox ESR 153.6. This article is for the normal Firefox most people download. If you deliberately run ESR, update to the ESR version instead of 159.

Malwarebytes covered Firefox 159 alongside Chrome’s October 27 update.

Why 158.x is not enough anymore

Firefox 158.0.1, released October 20, fixed the issues in MFSA 2026-111 and shipped an updated block list for compromised eMudhra certificates. That install still mattered. It does not include the Firefox 159 security fixes.

Same habit every time:

1. Update
2. Fully quit and relaunch
3. Prove it with about:support

Downloaded is not running. The version line is the receipt.

How to update and verify on your computer

1. Open Firefox on the computer you actually browse with.
2. Check for updates.
   • Windows / Linux: Menu (three lines) > Help > About Firefox.
   • macOS: Firefox menu > About Firefox.
3. Stay on the About window until the download finishes. Firefox usually says it is downloading or ready to restart.
4. Restart to update when prompted. Do not click Later and keep working in old windows.
5. Fully quit if the version still looks old. Close every Firefox window. On Windows, confirm in Task Manager that no firefox.exe processes are left. On Mac, use Firefox > Quit Firefox. Then open Firefox again.
6. Verify with about:support. Type that into the address bar. In the Application Basics section, read Version. You want 159.0 (or a newer 159.0.x if Mozilla ships a point release after this article).
7. Repeat on other home computers that still run Firefox, including a laptop that stays open for days and any shared family computer.

If About Firefox does not offer 159 yet, wait a day for the rollout to reach you, then check again. If the updater seems stuck, download Firefox from Mozilla’s own site instead of a third-party download page.

Linux users who installed Firefox from their distribution’s packages should update through that package manager. Flatpak or Snap installs update through those tools. The goal is still 159.0.

Phone browsers are separate

Desktop Firefox updates do not patch Firefox on iPhone or Android. Those apps update through the App Store or Google Play on their own schedules. If you browse in Firefox on a phone, check the store listing and open the app once after it updates so the new build actually launches.

Thunderbird is separate too

If you also use Thunderbird for mail, update it from its own About screen. Mozilla shipped Thunderbird 159 the same day with mail-specific fixes. Updating Firefox does not update Thunderbird.

Do this / don’t do that

Do

• Open About Firefox, relaunch, and confirm about:support shows 159.0.
• Treat a high-impact security advisory as “install today,” not “install when I remember on Sunday.”
• Update Chrome, Edge, Brave, and Safari on their own if you use them. Updating Firefox does not update them.
• If you run ESR on purpose, follow the October 27 ESR advisories instead.

Don’t

• Do not stop at 158.0.1 because you already “did the Firefox update” last week.
• Do not assume a Windows restart alone applied 159 if about:support still shows 158.x.
• Do not download “Firefox offline installer” packs from third-party sites. Use Firefox’s own About window or Mozilla’s download page.

Bottom line

On October 27, 2026, Mozilla shipped Firefox 159.0 with MFSA 2026-118, a high-impact advisory covering 167 fixed vulnerabilities (release notes). On your own computer: install, relaunch, and verify about:support. Last week’s 158.0.1 update was worth doing. 159.0 is the new finish line.

Image: Official Firefox tracking protection illustration (firefox.com/features) on a soft lavender background.