Mozilla shipped Firefox 156 on September 15. The release patches 73 security vulnerabilities, speeds up the built-in PDF viewer by as much as 45 percent, and adds a startup option for macOS. It is the first Firefox release since the browser moved to a two-week update cadence. The size of its security advisory is a direct result of that change.
73 vulnerabilities, but not what it looks like
Mozilla’s advisory for this release, MFSA 2026-90, lists 73 individual CVEs. Of those, 29 are rated high impact, 24 moderate, and 20 low. That is a bigger number than most past Firefox advisories. It is tempting to read it as a bad month for browser security, but it isn’t quite that.
Mozilla explains the jump in the advisory itself: “We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.” Previously, a batch of similar memory-safety fixes found during internal testing was often reported under one shared CVE. Now each bug gets its own listing. That inflates the count without necessarily meaning more bugs shipped this cycle.
The high-impact fixes are still worth knowing about. They include a use-after-free flaw in the Audio/Video Web Codecs component and several privilege-escalation bugs in Graphics: CanvasWebGL. There’s also a sandbox escape in DOM: Core & HTML, and a mitigation bypass in the Remote Settings Client. Mozilla’s advisory does not list any of these as being exploited in the wild. Update anyway — Firefox does this automatically, but you can force it from Menu > Help > About Firefox.
PDF viewer loads up to 45 percent faster
Firefox’s built-in PDF viewer now starts up to 45 percent faster, according to Mozilla’s release notes. The browser also uses less memory and CPU when displaying large JPEG images that get scaled down to fit a page. Windows PCs running on ARM64 chips get a separate change. WebRTC video calls on those machines can now use hardware H264 decoding instead of falling back to software. That should mean smoother video calls and less battery drain on ARM laptops.
macOS gets a launch-at-startup option
Firefox on macOS can now be set to open automatically when the Mac starts up. The toggle sits in the Startup section of Firefox’s Settings. It is a small addition, but Windows and Linux versions of Firefox already had it. This closes a long-standing gap for Mac users who keep the browser open all day.
Ad-style suggestions land in three more countries
Mozilla is also expanding address bar suggestions to France, Germany, and Italy. The rollout adds localized Wikipedia results alongside what the release notes describe as “occasional sponsored suggestions.” In plain terms, paid placements can now show up as you type in the address bar in those markets, not just organic search matches. Mozilla frames this as a feature addition. It is also new ad inventory in a part of the browser users generally expect to be a clean, private search box. The setting is on by default. You can turn it off from Firefox Suggest in Settings, under Search.
Other fixes worth knowing
- Fixed dragging an image inside a rich-text editor sometimes replacing it with a long line of text instead of moving it.
- Fixed high-sample-rate FLAC audio inside MP4 files failing to play on sites like Bilibili.
- Fixed subtitles not appearing in a Picture-in-Picture window when turned on after the window was already open.
- Fixed bookmarks moving out of their folder when a folder and its contents were selected and dragged together in the Bookmarks sidebar.
- Fixed the find bar becoming permanently unavailable in a tab after reversing panes in Split View.
- Fixed some sites failing to load when DNS over HTTPS is enabled and the site doesn’t support HTTPS.
- Fixed Firefox’s built-in VPN sometimes cutting all network connectivity for affected users.
- Fixed Firefox blocking an auto-hiding Windows taskbar from appearing.
How to get it
Firefox 156 is rolling out now to Release channel users on Windows, macOS, and Linux. Most installs update automatically. To check manually, open Firefox, go to Menu > Help > About Firefox, and let it download and restart. Firefox ESR users get the relevant security fixes in ESR 153.3 rather than the full feature set.
Source: Mozilla Firefox 156 release notes, Mozilla Foundation Security Advisory 2026-90
