Mozilla has released Firefox 158 for Windows, macOS, Linux, and Android, delivering a mix of user-facing improvements and a large security update. The new version introduces AI-assisted form filling under the Smart Windows feature, adds native support for the JPEG XL image format, and improves the way web pages are saved as PDFs. Alongside those changes, Firefox 158 patches 77 security vulnerabilities, 30 of which Mozilla rates as high risk.

The release follows Firefox 157 and its Nova design refresh, which focused on the browser interface. Firefox 158 is more about technical refinement and behind-the-scenes maintenance. Mozilla is rolling out the AI form-filling feature gradually, so not every user will see it immediately after updating. The company has also published updated Extended Support Release builds for organizations and users who prefer a slower update cadence.

Key facts at a glance

• Firefox 158 is available for Windows, macOS, Linux, and Android.
• The update adds an AI-powered Smart Windows feature that helps users fill out forms automatically.
• Native JPEG XL image support arrives after the format spent time as a Firefox Labs experiment.
• PDF export now produces more accessible files, and several PDF rendering issues have been fixed.
• Mozilla fixed 77 security flaws in Firefox 158: 30 high risk, 33 medium risk, and 14 low risk.
• The security fixes include 24 use-after-free vulnerabilities and eight sandbox-escape issues.
• External researchers reported 37 of the flaws; one researcher contributed nine reports.
• Firefox ESR 153.5.0 includes 61 fixes, while Firefox ESR 115.43 includes 17 fixes.
• Firefox 159 is scheduled for release on October 27, 2026.

AI-assisted form filling arrives gradually

The most visible new feature is the AI-based Smart Windows form-filling tool. Mozilla describes it as a way to help users complete web forms more quickly by reducing repetitive typing. The feature is designed to work across common online forms, such as contact pages, checkout flows, and registration screens, although the exact behavior will depend on the page and the data a user has made available to the browser.

The rollout is gradual. That means some users may update to Firefox 158 and see no sign of the feature at first, while others may receive it through a staged server-side release. Gradual deployment is common for features that rely on machine learning or cloud services, because it lets developers monitor reliability, performance, and user feedback before a full launch. It also limits the blast radius of any unexpected problem.

For users, AI-assisted form filling can save time, but it should not be treated as a reason to stop reviewing personal information before submission. Forms often contain sensitive details such as addresses, phone numbers, payment information, and identity data. A browser assistant may suggest values based on previously entered information, but the user remains responsible for checking that every field is accurate and that the form is on a legitimate site. Mozilla has not framed the feature as a replacement for careful review, and the gradual rollout gives users time to adjust.

JPEG XL support moves from experiment to default

Firefox 158 also adds support for JPEG XL, an image format that has been available as a Firefox Labs experiment since June. JPEG XL is designed to compress images more efficiently than older formats such as JPEG, PNG, and WebP while maintaining comparable image quality. In practice, that can mean smaller files for the same visual result, faster page loads on slow connections, and lower storage costs for sites that serve large image libraries.

The format has a long and somewhat complicated history on the web. It was developed as a successor to JPEG, with support for both lossy and lossless compression, high dynamic range, wide color gamut, and progressive decoding. One of its notable technical goals is to allow lossless transcoding from existing JPEG files, which can help sites migrate without re-encoding every image from scratch. Browser support has been uneven, however, and JPEG XL has spent years as a subject of debate among web developers, image engineers, and browser vendors.

Firefox moving JPEG XL from an experiment to a supported feature gives the format another major browser endorsement. It does not guarantee that every website will adopt JPEG XL, because site owners must still weigh encoding workflows, CDN support, and fallback strategies. But native support in Firefox reduces one barrier: users will no longer need to enable a lab flag or rely on a separate extension to view JPEG XL images. For image-heavy sites, the change could make it easier to test JPEG XL alongside existing formats and measure real-world savings.

PDF improvements and accessibility

Another practical change involves saving web pages as PDFs. Firefox now generates more accessible PDF files, meaning the output should present fewer barriers for people who use screen readers, keyboard navigation, or other assistive technology. Mozilla also says it has fixed a number of other shortcomings in PDF rendering. Those fixes are less flashy than AI form filling, but they matter for anyone who regularly archives articles, receipts, reports, or government documents.

Accessible PDFs are not simply PDFs that look correct on screen. They need a logical structure, readable text order, proper headings, and other metadata that assistive tools can interpret. When a browser exports a web page to PDF, it must translate the page layout into a format that preserves meaning, not just appearance. Improvements in this area can help organizations meet accessibility requirements and can make digital archives more useful to a wider range of readers.

Security update: 77 flaws, 30 rated high risk

The security side of Firefox 158 is the most urgent part of the release. Mozilla lists 77 fixed vulnerabilities, including 30 classified as high risk, 33 as medium risk, and 14 as low risk. External security researchers discovered and reported 37 of the flaws. One researcher contributed nine separate reports, a notable level of contribution in a single release cycle.

Among the fixed issues are 24 use-after-free vulnerabilities. A use-after-free flaw occurs when software tries to use memory after it has been freed. In a browser, that kind of bug can sometimes be exploited to crash the application or, more seriously, to run malicious code. The advisory indicates that some of these flaws can be exploited for code execution, which is why high-risk ratings matter even when a vulnerability requires a complex attack chain.

Eight of the vulnerabilities could potentially allow an attacker to escape the browser sandbox. Sandboxing is a core security layer that tries to contain malicious code inside a restricted environment. If an attacker can escape the sandbox, the impact of a successful exploit can grow significantly, because the attacker may gain access to more of the operating system and user data. Modern browsers rely on multiple layers of defense, and sandbox escapes are treated seriously because they undermine one of the strongest protections.

Users should update Firefox as soon as possible. Browser updates are not just about new features; they close attack surfaces that can be targeted through malicious websites, compromised advertisements, or crafted files. The large number of memory-safety fixes in this release makes prompt patching especially important. Automatic updates usually handle the process, but users who have disabled them or delayed them should check their browser version manually.

ESR updates and older platform support

Mozilla has also released Firefox ESR 153.5.0 and Firefox ESR 115.43.0. The ESR branches are aimed at organizations and users who prefer a slower, more predictable update schedule. In the ESR versions, Mozilla fixed the same flaws that were present in the code of those older browser generations. That amounts to 61 fixes in Firefox ESR 153.5.0 and 17 fixes in Firefox ESR 115.43.

Firefox ESR 115.43 is only available for Windows 7 and 8.1 and for macOS 10.12 through 10.14. Mozilla plans to keep that legacy branch available until March 2027. The continued support matters for institutions that still run older operating systems, even though those platforms no longer receive mainstream vendor support. Firefox ESR 140 received its final update on September 29, which makes the transition to a supported ESR branch important for administrators who have not yet migrated.

Why this release matters

Firefox 158 is a reminder that browser releases now carry two very different kinds of risk. On one side, new features such as AI form filling and JPEG XL support can change how people interact with the web. On the other, the security fixes address vulnerabilities that may never appear in a feature list but are far more important for day-to-day safety. A browser is one of the most exposed pieces of software on a computer, and every release cycle brings a new set of flaws into public view.

The gradual rollout of AI form filling also reflects a broader shift in browser development. Features that use machine learning are often deployed carefully, because they can behave differently across languages, sites, and user data. Mozilla has to balance convenience with privacy and reliability, and users should expect more staged releases in the future. JPEG XL support, meanwhile, shows that format battles on the web are still active. Even a technically efficient standard needs browser adoption, content creator tooling, and site owner interest before it can become common.

For most users, the immediate action is simple: install the update, restart the browser, and confirm that the version number has changed. Administrators should review ESR coverage and make sure older devices are on a supported branch. Firefox 159 is scheduled for release on October 27, 2026.

Source:PCWorld News