Firefox 158 is out for Windows, macOS, Linux, and Android. This version brings improved PDF support, the ability to fill forms with the help of “AI,” as well as fixes for over 75 security vulnerabilities. Updates are also available for Firefox ESR versions.

Firefox 159’s release is scheduled for October 27th, 2026.

What’s new in Firefox 158?

Following the new Nova design introduced in Firefox 157, now a few technical boosts are being rolled out. The AI-based Smart Windows feature is designed to help users fill in forms more quickly. It’s being rolled out gradually, so it won’t be available to all users straight away.

Another improvement involves the saving of web pages as PDFs. Firefox now generates more accessible PDF files (i.e., fewer barriers), and a number of other shortcomings in PDF rendering have been fixed.

Firefox now supports the JPEG XL image format, which has been running as a Firefox Labs experiment since June. Image compression with JPEG XL is more efficient than with older formats like JPEG, PNG, and WebP, all while maintaining comparable image quality.

Security flaws fixed in Firefox 158

In the security advisory for Firefox 158, Mozilla lists 77 security flaws that have been fixed, 37 of which were discovered and reported by external security researchers (OpenAI’s Amy Burnett stands out with 9 reports).

Mozilla classifies 30 vulnerabilities as “high risk,” 33 as “medium risk,” and 14 as “low risk.” Among the fixed security vulnerabilities are 24 use-after-free (UAF) flaws, some of which can be exploited to run malicious code. Eight vulnerabilities can be exploited to escape the browser’s sandbox.

Firefox ESR updates

In addition to Firefox 158.0, ESR versions 153.5.0 and 115.43.0 are also now available. However, the latter is only available for Windows 7 and 8.1 and macOS 10.12 to 10.14, and will remain so until March 2027.

In the ESR versions, Mozilla has fixed the same aforementioned flaws that were also present in the code of these older browser generations. That amounts to 61 fixes in Firefox 153.5.0 and 17 in Firefox 115.43. (Firefox ESR 140 received its final update on September 29th.)

Yesterday was October Patch Tuesday, and Microsoft’s security updates addressed 1,416 new vulnerabilities. Not only is that another record broken, but it’s also the first time over 1,000 flaws were fixed in a single month. Indeed, October 2026 saw more security vulnerabilities fixed in the month than were fixed in any previous year.

Alongside flaws fixed in Windows and Office, we also saw a bunch of fixes in Exchange Server, SQL Server, Hyper-V, Skype for Business, Microsft Defender, .NET Framework, Visual Studio, and Microsoft’s cloud services.

Microsoft classifies 85 of the 1,416 vulnerabilities as “critical,” including 67 remote code execution (RCE) vulnerabilities. The other vulnerabilities are classified as “high risk,” with one vulnerability already being exploited in the wild while two were publicly known in advance.

The next Patch Tuesday is scheduled for November 10th, 2026.

Windows security vulnerabilities

A large number of the vulnerabilities—over 1,000 this time—are spread across the various Windows versions (10, 11, Server) for which Microsoft still provides security updates, including Windows 10 via the Extended Security Updates program, which was extended until October 12th, 2027.

Note: If you’re still on Windows 11 24H2, this is your last Patch Tuesday. Computers running 24H2 will no longer receive security updates going forward. When prompted by Windows Update, you should upgrade to Windows 11 25H2 or 26H2. That’ll keep you secure and up to date.

Windows under attack

One Windows security vulnerability is already being exploited in the wild this month. CVE-2026-96951 in the Windows Shell allows attackers to bypass the system’s defenses by disguising the origin of an executable file from the internet (Mark of the Web, or MotW).

Critical Windows vulnerabilities

Microsoft has classified 42 Windows vulnerabilities as critical, including 30 RCE vulnerabilities. Via these flaws, an attacker could remotely execute injected code without authentication or user interaction. The malicious code could then spread further across the network.

Microsoft Edge security vulnerabilities

The latest security update to Microsoft Edge 155.0.4283.45 is dated October 8th and based on Chromium 155.0.8059.40. It addresses 247 Chromium vulnerabilities, which are not included in the sum of flaws fixed in Microsoft Edge this month.

Microsoft Office security vulnerabilities

Microsoft has fixed 194 vulnerabilities in its various Office products, including 25 RCE vulnerabilities classified as critical. With “critical” RCE vulnerabilities in Office, the preview pane is usually an attack vector—a user doesn’t need to open an infected file for an attack to succeed, but rather only needs to preview it in the preview pane. Meanwhile, “high risk” RCE vulnerabilities usually require a user to open an infected Office file in a vulnerable Office product (open-and-own).

Among the numerous vulnerabilities in SharePoint, CVE-2026-102866 is an elevation of privilege (EoP) vulnerability that Microsoft classifies as critical. It is also the only SharePoint vulnerability that an attacker could exploit without a user login. They would need to obtain a valid user token, modify it, and impersonate that user on the server.

Exchange Server security vulnerabilities

Microsoft has fixed 7 vulnerabilities in Exchange Server this month. Six of these are classified as high risk, including five EoP vulnerabilities. CVE-2026-70571 is also included, an RCE vulnerability classified as critical.

Sure, we all use AI in our everyday lives now, but what about taking a crack at training your own? Google Labs has a really cool project called Teachable Machine, which allows you to create and train your own basic AI model. The best part? You don’t need to know a thing about coding to do it.

Right now it’s limited to making models that recognize images, sounds, and body poses. More capabilities may arrive in the future. Teach it the difference between a ripe banana and a green one, how to recognize a clap instead of a whistle, or even to tell whether you’re sitting or standing. Those are just ideas off the top of my head. You can let your imagination run wild.

On the Teachable Machine website, click Get Started and choose whether you want to work with images, audio, or poses. Now it’s time to train the model by giving it examples to learn from. So, for example, if you’re training it to recognize images, you can upload photos or just use your webcam to show it different objects—the more examples the better. It’ll ask you to give each group of examples a name. Now click Train Model and watch it get to work.

Once training is complete, you can show it new photos or use your webcam to see how well it recognizes different objects in real time. If it isn’t getting things right, then it’s time to get back to training. Add more examples, train it again, and see if it improves. It’s a great way to get a feel for why the data you feed an AI model is so important.

If you want to take things a step further, you can even export your trained model and use it in your own website or app, although you’ll probably need some coding know-how for that. Otherwise, Teachable Machine is a fascinating afternoon project and an easy way to dip your toes into AI development.

For more fun and helpful tips, tricks, website and app recommendations, be sure to subscribe to our PCWorld Try This newsletter.