Firefox 159 was released on 27 October for Windows, macOS, Linux and Android. The update brings a security refresh: Mozilla fixed 167 vulnerabilities in it and added new features. According to advisory MFSA 2026-118, these are 108 high-risk flaws, 52 medium and 7 low.
Firefox 159 and the security refresh: 167 fixes
The list of fixes includes 97 use-after-free bugs, some of which could have allowed malicious code to be injected and executed. On sandbox escapes, the sources differ: one release description speaks of 13 vulnerabilities that could be exploited for this, while Notebookcheck states that Mozilla itself found the only sandbox escape. External researchers reported 65 flaws, 34 of them from OpenAI Codex Security and 7 from Amy Burnett of OpenAI.
New features: passwords in the sidebar and Smart Window
Saved passwords are now available in the sidebar by default, even if you do not save them in Firefox. According to Mozilla, the Smart Window feature is meant to monitor changes on websites, such as new blog posts or price changes. It is being rolled out gradually, so not all users have it yet. According to Notebookcheck, it is available in English for the US and Canada and in French.
Firefox ESR and other releases
Mozilla also released the ESR versions Firefox 153.6.0 and 115.44.0. In the first, it fixed 145 vulnerabilities, and in the second, 80. ESR 115.44.0 is intended for Windows 7 and 8.1 and macOS 10.12 to 10.14, through March 2027. According to SecurityWeek, Thunderbird 159 and 153.6 were also released. Firefox 159 no longer supports Windows 8.1 and older or macOS 10.14 and older.
Searching among open tabs is now invoked with the shortcut Ctrl+Shift+A, on macOS Cmd+Shift+A. The Summarize feature sends the page address, not its text, to the selected chatbot. According to Notebookcheck, neither Mozilla nor Google report exploitation of these flaws in real-world attacks. The next major version, Firefox 160, is scheduled for 10 November.