Firefox 158 fixes high-impact vulnerabilities in the web runtime

Mozilla has published the Firefox 158 security advisory with a broad set of vulnerabilities rated high impact. The announcement affects components at the foundation of modern browsing: site isolation, networking, storage, graphics, the DOM, WebIDL, Canvas, WebGL, WebAssembly, and the JavaScript engine.

The defects include privilege escalation in the update component, sandbox escapes, and site-isolation problems involving use-after-free conditions or incorrect boundaries. Mozilla also fixes several use-after-free cases in IndexedDB, text rendering, Canvas2D, XML, SVG, audio and video, Streams, and animations. The advisory additionally lists incorrect boundaries in the JavaScript engine, JIT miscompilation issues, and a JIT problem in WebAssembly. These are not failures in one application API; they affect the layers that turn potentially hostile web content into executable code inside the browser.

Mozilla has also changed how it publishes these advisories. Instead of grouping all internally identified memory-safety vulnerabilities under one CVE, it now issues a separate identifier for each defect. That improves traceability. Teams can connect each issue to its component, its Bugzilla report, and its fix, while avoiding a single record that hides the actual variety of defects a security team must review.

For web developers, the announcement does not necessarily mean changing a particular application. Its importance is that the browser is part of the product’s execution surface. An application using IndexedDB, Canvas, WebAssembly, graphics APIs, or optimized JavaScript depends on a chain of native components, compilers, and isolation boundaries that the frontend team does not directly control.

The practical response is to keep browsers in development, testing, and production within supported versions, and to include the relevant scenarios in the compatibility matrix: persistent storage, 2D and 3D graphics, WebAssembly modules, workers, and third-party content. Application tests do not replace browser patches, but an explicit matrix helps teams identify whether an update affects a sensitive flow.

The advisory also shows an uncomfortable property of browser security: protection depends on several layers working together. Memory safety does not remove every logic flaw; the sandbox limits impact but does not make an escape harmless; and the JIT engine needs its own validation because it turns dynamic code into native instructions. That is why advisories are best read by component, not only by version number. Firefox 158 is the available fix, but the durable lesson is operational: runtime updates are part of maintaining any web system.