Firefox 158 and ESR 153.5 fix sandbox escapes and dozens of memory bugs

Firefox 158 and ESR 153.5 fix sandbox escapes and dozens of memory bugs

13 October 2026: Mozilla has fixed a privilege escalation in Firefox's update component (CVE-2026-109704) and several sandbox escapes in Firefox 158, released with advisories on 13 October that rate the batch high impact. Firefox ESR 153.5, Firefox ESR 115.43, Thunderbird 158 and Thunderbird 153.5 carry the corresponding fixes. Mozilla does not report any of the flaws as exploited.

Fixed versions

• Firefox 158 (MFSA 2026-106, 77 CVEs)
• Firefox ESR 153.5 (MFSA 2026-108, 61 CVEs)
• Firefox ESR 115.43 (MFSA 2026-107, 17 CVEs)
• Thunderbird 158 (MFSA 2026-109, 80 CVEs)
• Thunderbird 153.5 (MFSA 2026-110, 62 CVEs)

Why the CVE count jumped

The numbers look alarming because Mozilla has changed how it publishes. Its advisory notes that it no longer rolls internally found memory safety bugs into one combined CVE and now issues one for every individual bug. Most of the Firefox 158 entries are use-after-free, boundary and JIT miscompilation bugs in the JavaScript engine, WebAssembly, graphics, DOM and layout components, the class of flaw that has historically been turned into remote code execution when chained.

The entries that deserve attention first are the ones that cross a security boundary. CVE-2026-109705, CVE-2026-109707 and CVE-2026-109708 are sandbox escapes in the networking component; CVE-2026-109712 and CVE-2026-109745 are sandbox escapes through uninitialised memory in graphics and in Web Serial; CVE-2026-109740 is a sandbox escape in the Win32 widget code; and CVE-2026-109709 is an information disclosure and privilege escalation in process sandboxing. CVE-2026-109704 itself, the update component flaw reported by an outside researcher, matters on any machine where the browser updater runs with elevated rights.

Policy bypasses for managed fleets

Two entries are specific to organisations that configure Firefox centrally: CVE-2026-109737 and CVE-2026-109764 are mitigation bypasses in the Enterprise Policies component. Mozilla's advisory does not detail them, but a bypass of enterprise policy can undo controls such as blocked extensions or forced settings, so fleets that rely on policies.json or Group Policy for Firefox should treat the update as more than routine.

Organisations on the extended support release should note which branch they run. ESR 153.5 picks up most of the Firefox 158 fixes, while the older ESR 115 line gets a smaller set in 115.43. Thunderbird shares the Gecko engine and the same classes of bug, so mail clients need updating too, especially where Thunderbird renders HTML mail.

The Canadian Centre for Cyber Security published its own advisory on the releases on 16 October and encourages users and administrators to apply the updates. Our patch management software category lists seven products.

Sources

• Mozilla Foundation Security Advisory 2026-106: Security Vulnerabilities fixed in Firefox 158, 13 October 2026
• Mozilla Foundation Security Advisory 2026-108: Security Vulnerabilities fixed in Firefox ESR 153.5, 13 October 2026
• Mozilla Foundation Security Advisory 2026-109: Security Vulnerabilities fixed in Thunderbird 158, 13 October 2026
• Canadian Centre for Cyber Security: Mozilla security advisory (AV26-1057), 16 October 2026