Firefox 159 is now rolling out with one of Mozilla’s largest security updates of the year, bringing fixes for 167 vulnerabilities across Windows, macOS, Linux, and Android. The update began arriving on October 27 and is recommended for all users, especially because many of the patched flaws are considered high severity.
According to Mozilla’s security advisory, Firefox 159 addresses 108 high-severity issues, 52 moderate-severity issues, and 7 low-severity issues. No vulnerability in this release is classified as critical, and Mozilla has not reported any evidence that the flaws were actively exploited before the update became available.
A major highlight of this release is the role artificial intelligence played in finding security bugs. Mozilla credits 34 of the fixed vulnerabilities to OpenAI Codex Security, an AI-powered security research agent introduced as a research preview earlier this year. OpenAI researcher Amy Burnett reported another 7 issues, bringing OpenAI’s total contribution to 41 of the 167 patched vulnerabilities.
Many of the most serious flaws fixed in Firefox 159 are use-after-free vulnerabilities. These happen when software continues to use memory after it has already been released, potentially allowing attackers to crash the browser, corrupt data, or in more dangerous cases, execute malicious code. While not every use-after-free bug is easy to exploit, they are treated seriously because of the risks they can pose in real-world attacks.
Mozilla also fixed a sandbox escape issue in this update, although that particular vulnerability was discovered internally by Mozilla rather than by an outside researcher or AI system. Sandbox escapes are especially important because browser sandboxes are designed to limit what malicious web content can do on a user’s device. If attackers can break out of that protection, the impact of an exploit can become much more severe.
Firefox 159 also shows how AI tools are becoming more involved in software security work. This is not the first time AI systems have helped uncover Firefox vulnerabilities. Earlier this year, another AI model was used to analyze thousands of C++ files from the browser’s codebase, leading to the discovery of multiple security issues that Mozilla later fixed. At the same time, AI is not perfect. Some vulnerabilities can still be missed, including serious bugs that require human expertise to identify and verify.
The unusually large number of fixes in Firefox 159 is not only because more bugs were found. Mozilla has also changed the way it reports some vulnerabilities. In the past, internally discovered memory safety issues were often grouped together under a single CVE entry. Now, Mozilla publishes separate entries for individual issues, making the total count appear higher than in older Firefox releases. Because of this reporting change, the vulnerability count in Firefox 159 should not be compared directly with older browser updates.
For most users, Firefox should update automatically in the background. Anyone who wants to check manually can open the Firefox menu, go to Help, and select About Firefox. The browser will show the installed version, download the latest update if one is available, and prompt for a restart to complete the installation.
Firefox 159 also ends support for older operating systems. The new version no longer supports Windows 8.1 and earlier or macOS 10.14 and earlier. Mozilla recommends that users on those systems move to Firefox ESR, the Extended Support Release version, which continues to receive important security updates for older platforms.
Beyond security fixes, Firefox 159 introduces several usability changes. Saved passwords are now available from the sidebar by default, making it easier for users to access login credentials without digging through settings. The browser also changes the shortcut for searching open tabs. On Windows and Linux, users can now press Ctrl+Shift+A, while macOS users can use Cmd+Shift+A.
Mozilla has also adjusted how its AI chatbot summarization feature works. Instead of sending the full text of a webpage to a chatbot provider, the browser now sends the page address. This should help prevent long pages from being cut off during summarization and may make the feature more reliable for lengthy articles, documentation, and research pages.
Another AI-related addition is expanding through Firefox’s Smart Window feature. Smart Window can now monitor webpages for price drops, restocks, and similar changes. Users can type /watch in the chat to set up a watch, and Firefox will send a desktop notification when it detects a matching update. Mozilla says the feature is rolling out gradually and is currently available in English in the United States and Canada, as well as in French.
Users who do not want AI features in Firefox can turn them off through the browser’s AI controls in settings.
Firefox 159 is an important update for anyone who values browser security. With 167 vulnerabilities fixed, expanded AI-assisted bug discovery, and several new convenience features, the release highlights both the growing complexity of modern browsers and the increasing role AI may play in keeping them secure.
