Firefox 158 is now available for Windows, macOS, Linux, and Android, bringing a mix of user-facing improvements and a substantial security update. The release introduces an AI-assisted form-filling feature called Smart Windows, adds support for the JPEG XL image format, improves PDF output, and fixes 77 security vulnerabilities. Mozilla has scheduled Firefox 159 for October 27, 2026, keeping the browser on its regular rapid-release cadence.

What is new in Firefox 158?

The headline feature is Smart Windows, an AI-based tool intended to help users complete online forms more quickly. Mozilla is rolling it out gradually, so the option will not appear for every user at once. That staged approach is common for browser features that depend on model behavior, user feedback, and platform differences. The feature follows the Nova design introduced in Firefox 157, which focused on a refreshed interface; Firefox 158 shifts attention toward technical and workflow improvements.

Form filling is one of the most repetitive parts of browsing. Shopping checkouts, travel bookings, account registrations, job applications, and government services all rely on structured fields. An AI-assisted tool can reduce the time spent typing the same details and may help users avoid skipped fields or formatting mistakes. At the same time, forms often contain personal information, so the value of the feature will depend on clear controls, predictable behavior, and sensible data handling. Because the rollout is gradual, users will have time to evaluate the feature as it reaches their systems.

PDF and image support

Firefox 158 also improves the process of saving web pages as PDFs. Mozilla says the browser now generates more accessible PDF files, meaning documents with fewer barriers for people who rely on assistive technology or other accessibility tools. The release also fixes several PDF rendering shortcomings. PDF output is often used for invoices, tickets, reports, receipts, and archived web content, so small improvements in accessibility and rendering can have a wide practical effect.

Another addition is native support for JPEG XL images. The format had been available as a Firefox Labs experiment since June, and Firefox 158 moves it into the main browser. JPEG XL compresses images more efficiently than older formats such as JPEG, PNG, and WebP while maintaining comparable image quality. For websites, that can mean smaller files and lower bandwidth use. For readers, it can mean faster image loading without an obvious drop in visual quality. Support in a major browser also gives publishers more reason to consider the format when serving image-heavy pages.

Security fixes in Firefox 158

The security side of the release is extensive. Mozilla lists 77 security flaws fixed in Firefox 158, with 37 of those discovered and reported by external security researchers. One researcher accounted for nine separate reports, according to the advisory. Mozilla rates 30 of the vulnerabilities as high risk, 33 as medium risk, and 14 as low risk.

Among the fixed issues are 24 use-after-free flaws. A use-after-free bug occurs when software tries to use memory after it has been freed. In a browser, that kind of memory corruption can lead to crashes, and some instances can be exploited to run malicious code. The presence of 24 such flaws in a single release illustrates why browser updates are not routine housekeeping. Browsers process untrusted web content constantly, so memory-safety defects remain a serious attack surface.

Eight of the vulnerabilities could potentially be exploited to escape the browser sandbox. Sandboxing is a defense-in-depth measure that limits what code can do even if an attacker compromises a renderer or another isolated browser component. A sandbox escape raises the severity of an attack because it can turn a contained compromise into a broader system-level threat. Mozilla’s classification does not mean every flaw was exploited in the wild, but it does show the range of risk addressed by the update.

Firefox ESR updates

Alongside Firefox 158.0, Mozilla has published updates for its Extended Support Release branches. Firefox ESR 153.5.0 includes 61 fixes, while Firefox ESR 115.43.0 includes 17. The ESR versions receive the same underlying security corrections where they apply to the older codebases. ESR channels are used by organizations and individuals who need a longer support window and a slower feature cadence than the standard release.

Firefox ESR 115.43.0 is available only for Windows 7 and 8.1 and for macOS 10.12 through 10.14. Mozilla says that branch will remain available until March 2027, giving users on older operating systems a defined support period. Firefox ESR 140 received its final update on September 29, which is a reminder that even extended-support products eventually reach end of life. Administrators should track those dates carefully because an unmaintained browser becomes a growing security liability.

Why the update matters

Browser releases now carry two kinds of urgency. The first is functional: users gain new features such as AI-assisted form filling, JPEG XL decoding, and better PDF export. The second is security: a release that fixes 77 flaws, including 30 high-risk issues, closes gaps that attackers could study and attempt to exploit. The longer a browser remains unpatched, the more time defenders lose and the more opportunity attackers gain.

The sandbox and use-after-free fixes deserve particular attention because browsers are among the most exposed applications on a typical computer. They open documents, render complex media, run scripts, and connect to remote services. A single crafted page can exercise a large amount of code. Security teams therefore treat browser updates as a high-priority maintenance task, especially when high-risk memory corruption issues are involved.

For individual users, the practical advice is straightforward: install the update promptly and restart the browser if required. For managed environments, testing should be balanced against the risk of leaving known flaws unpatched. Organizations that rely on ESR should verify which branch they use, confirm the available fixes, and plan for the end-of-support dates that apply to older platforms.

Release timing and planning

Firefox 159 is scheduled for October 27, 2026, which gives users and administrators a short window to absorb Firefox 158 before the next feature release arrives. Mozilla’s rapid cadence keeps security fixes moving, but it also means that update planning cannot be postponed indefinitely. Users on older operating systems should note the March 2027 support boundary for Firefox ESR 115.43.0 and begin planning their migration before that date.

The release also shows how browser competition now spans features and maintenance at the same time. AI-assisted form filling is a workflow feature, JPEG XL is an image-format decision, accessible PDFs are an inclusion improvement, and the security advisory is a reminder of the engineering work that happens outside the visible interface. Firefox 158 may not change every user’s daily routine at once, but its combination of new capabilities and security repairs makes the update relevant across desktop and mobile platforms.

Source: PCWorld News