Firefox 159 fixes 167 flaws, and OpenAI's Codex found 41 of them

Mozilla began rolling out Firefox 159 for Windows, macOS, Linux and Android on Oct. 27. According to the security advisory for Firefox 159, the release fixes 167 vulnerabilities. Mozilla rates 108 of them high, 52 moderate and 7 low. None is rated critical, and the advisory does not report any active exploitation.

OpenAI reported about a quarter of the bugs

Mozilla credits 34 of the entries to OpenAI Codex Security, the security agent OpenAI launched as a research preview in March. OpenAI researcher Amy Burnett reported 7 more, which brings OpenAI's share to 41 of the 167 fixes. Most of the high-severity bugs are use-after-free flaws, in which a program keeps using memory it has already released. In the worst case, attackers can use such a bug to run malicious code. The only sandbox escape in the list was found by Mozilla itself.

AI has found Firefox bugs before. In February, Anthropic ran Claude Opus 4.6 against roughly 6,000 C++ files of the browser, which led to 22 CVEs that Mozilla fixed mostly in Firefox 148. These tools also miss bugs. In July, a root vulnerability was reported that Anthropic's AI had overlooked.

Why the number is so high

The count is also higher because Mozilla changed how it reports bugs. It no longer groups internally found memory safety bugs under one CVE and now publishes a separate entry for each of them. Counts from older Firefox releases are therefore not directly comparable. Apple's latest list was similarly long, with iOS 27.2 fixing 163 vulnerabilities.

How to update and what else is new

Firefox normally updates itself. To check, open the menu and go to Help and then About Firefox. The window shows the installed version, downloads any pending update and asks for a restart afterward. Firefox 159 no longer supports Windows 8.1 and earlier or macOS 10.14 and earlier, and Mozilla tells people on those systems to switch to Firefox ESR.

The release notes for Firefox 159 list a few more changes. "Saved passwords are now available from the sidebar by default," Mozilla writes. Searching open tabs now uses Ctrl+Shift+A on Windows and Linux or Cmd+Shift+A on macOS. The Summarize option for AI chatbots now sends the page's address to the chatbot provider instead of the page's text, so long pages are no longer cut short.

Smart Window, the AI window in Firefox, can now watch pages for price drops or restocks. Typing /watch in the chat sets up a watch, and Firefox sends a desktop notification when it finds a match. The feature is rolling out gradually. According to Mozilla, Smart Window is currently available only in English in the US and Canada and in French. Anyone who wants no AI in the browser can block it under AI controls in the settings.