---
title: Firefox 158 (MFSA 2026-106) fixes roughly 77 CVEs, including sandbox escapes and many OpenAI-reported JIT bugs | ctxsec
url: https://ctxsec.com/items/firefox-158-2026-10
description: ""
status: "confirmed (vendor)"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/firefox-158-2026-10.md)

confirmed (vendor)

2026-10-13

### Firefox 158 (MFSA 2026-106) fixes roughly 77 CVEs, including sandbox escapes and many OpenAI-reported JIT bugs

Mozilla's MFSA 2026-106 for Firefox 158 (Oct 13, impact: high) now issues one CVE per bug instead of rolling memory-safety bugs together, so the count is large: about 30 high, plus moderate and low issues. The high-impact list includes several Networking sandbox escapes (e.g. CVE-2026-109705/-109707/-109708), a Graphics sandbox escape (CVE-2026-109712), an Application Update privilege escalation (CVE-2026-109704) and a run of JavaScript/JIT/WebAssembly bugs credited to Amy Burnett of OpenAI (e.g. CVE-2026-109715, -109720, -109722, -109733). Mozilla does not flag any as exploited in the wild. Thunderbird 158/153.5 and Firefox ESR 153.5/115.43 carry many of the fixes, per SecurityWeek. Update and restart the browser.

Sources: [Mozilla MFSA 2026-106](https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/) · [SecurityWeek](https://www.securityweek.com/chrome-firefox-updates-patch-114-flaws-as-mozilla-unveils-firefox-enterprise/)