Mozilla releases Firefox 158.0.1 with fixes for four security vulnerabilities

Mozilla has published a security advisory for Firefox 158.0.1, announced on 20 October 2026. The advisory lists four vulnerabilities fixed in this version and gives the release an overall impact rating of High.

According to the advisory, the fixes cover:

• an incorrect boundary conditions issue in the SVG component (rated High)
• a cryptographic issue in the component that handles security block-lists and allow-lists (rated High)
• uninitialised memory in an audio and video component (rated Moderate)
• a denial-of-service issue in the built-in PDF viewer (rated Low)

The advisory doesn’t say that any of these flaws have been exploited.

Who it affects

People using Firefox on a computer. Mozilla published separate advisories for Firefox ESR 153.5.1 (the Extended Support Release, often used by organisations) on 20 October and Firefox for Android 158.0.2 on 21 October. Each lists a fix for the cryptographic issue.

What Mozilla’s help page says

Mozilla says Firefox updates automatically in most cases, and updates are applied after a restart. Its Update Firefox to the latest release page describes a manual check:

1. On Windows, open the menu button and select Help > About Firefox. On a Mac, open the Firefox menu and choose About Firefox.
2. Firefox checks for and downloads any available update.
3. When the download finishes, select Restart to update Firefox.

Mozilla notes that on Linux, a Firefox installed through the distribution’s package manager is updated through the system’s software updates instead.

Our browser privacy and security guide explains how browser updates and safety settings work.