Firefox 158 started rolling out on October 13, 2026, and the most important line in its paperwork is not a feature. Mozilla Foundation Security Advisory 2026-106 lists 77 vulnerabilities fixed in this release, 30 of them rated high impact.
The changes you can see are modest: JPEG XL images, smarter form filling in Smart Window, and a movable tab bar on Android. If you only update Firefox when it nags you, this is the release to update by hand.
TL;DR: Firefox 158 fixes 77 security bugs, including 30 rated high impact and several sandbox escapes. It also adds JPEG XL support, Smart Window form suggestions, more New Tab wallpapers and an Android tab bar that can sit at the bottom. The security fixes are the reason to update now, not the new features.
What Firefox 158 changes on your screen
The Firefox 158 release notes put Smart Window form filling first. When you click a form field, Firefox can suggest data from your open tabs and from saved autofill entries, and it is a progressive rollout, so you may not see it yet.
Most of the rest is quieter. Scrolling no longer rounds positions to whole screen pixels, so movement should look a little less steppy, and saved or printed PDFs are more accessible on Linux and macOS.
| Change | Platform | Detail |
|---|---|---|
| Smart Window form filling | Desktop | Suggests data from open tabs and saved autofill, progressive rollout |
| JPEG XL support | Desktop | Firefox can now display the format |
| New Tab wallpapers | Desktop | A library under Your images, not just the latest one |
| Translations | Desktop and Android | Albanian, Belarusian and Filipino added |
| Tab bar position | Android | Top or bottom, under Settings, then Customize |
| Security fixes | All | 77 CVEs in advisory MFSA 2026-106 |
On Android, the Android release notes add one change that people with big phones will notice quickly: the tab bar can now live at the bottom of the screen. That is a thumb problem solved, and it is the sort of setting you stop thinking about after a day.
JPEG XL arrives in Firefox
JPEG XL support is the headline web platform change, and Chrome is adding it as well. Our look at Chrome 155 and JPEG XL explains why the format matters: it can show a rough image that sharpens as it loads.
Nothing changes on a page until the site actually serves JPEG XL files, so do not expect a visible difference this week. What changes is that publishers have one less browser that cannot show the format.
Developers also get typed arithmetic in CSS calc(), WebAuthn conditional UI on inputs marked autocomplete="webauthn", and a few smaller APIs, all listed in the same notes. Those matter to people building sites, but they are also why the update is more than cosmetic.
Why the Firefox 158 security fixes matter
The advisory splits the 77 entries into 30 high, 33 moderate and 14 low. Among the high ones are sandbox escapes in the Networking component, one of which also involves a site isolation issue, plus a privilege escalation in the Application Update component and several JIT bugs in the JavaScript engine.
Those are the categories that matter because a sandbox exists to keep a bad web page from touching the rest of your computer. A flaw that lets code out of that box is the difference between a broken tab and a compromised machine. Mozilla’s advisory does not say any of these are being exploited, and it is worth saying that plainly.
The count looks dramatic partly because of a publishing change. Mozilla says it no longer rolls internally found memory safety bugs into a single CVE and now issues an advisory for every individual bug. A bigger number does not automatically mean a worse release, but it does mean more individual fixes you are missing if you skip the update.
The advisory also shows where the bugs came from. Amy Burnett of OpenAI is credited on 9 of the 30 high entries, and Mozilla itself on 14. That is a useful hint about how much bug hunting now happens before a release ships.
How to check you are on Firefox 158
Open the menu, choose Help, then About Firefox, and the browser will check for the update and download it. On Android, update through Google Play. Restart the browser when it asks, because the fixes do not apply to a session that is still running the old version.
For most people, the new wallpapers and the tab bar are a nice extra. The security advisory is what turns this from an optional update into a five minute chore worth doing today.
