Mozilla has released Firefox 159, a large security update that fixes 167 vulnerabilities across Windows, macOS, Linux and Android. The release began rolling out on 27 October, alongside new versions of the Extended Support Release branches, ESR 153.6 and ESR 115.44. Most users will receive it automatically, but anyone who has delayed updates can trigger a check from the browser's About Firefox window.

What the update fixes

Of the 167 flaws in Firefox 159, Mozilla rates 108 as high impact, 52 as moderate and 7 as low. None is rated critical, and the advisory does not report any active exploitation. Most of the high-impact flaws are memory-safety problems, including use-after-free errors, where a program keeps using memory it has already released, a fault that can in the worst case let an attacker run malicious code. The ESR 153.6 update fixes 145 flaws on the same day, so organisations running the extended-support version should update that channel too, not only the standard release.

Why the flaw count looks so large

The headline number is partly a counting change. Mozilla says it no longer rolls all internally identified memory-safety vulnerabilities into a single CVE entry, and now publishes a separate entry for each bug it finds itself. Totals from earlier releases are therefore not directly comparable. OpenAI's Codex security agent is credited with 34 of the entries, with OpenAI researcher Amy Burnett reporting seven more, bringing the AI-assisted share to 41 of 167, a striking illustration of how automated tools are now finding browser flaws at scale, alongside human review. The practical message is unchanged: a browser that renders untrusted web content every day should not be left on an old version, and this release is a good reason to check that the update has landed.

Sources: Notebookcheck and Malwarebytes.