Firefox 157.0.1 update fixes a file handling bypass vulnerability

Mozilla released a new security advisory for Firefox on October 6, 2026. Advisory MFSA 2026-104 covers a vulnerability fixed in Firefox 157.0.1. While the advisory marks the impact level as “moderate,” the NVD entry assigns the same vulnerability a critical CVSS score of 9.8.

Mitigation bypass in the File Handling component

The vulnerability CVE-2026-106016 allows a mitigation bypass in Firefox’s File Handling component. The vulnerability was reported by Abdulrahman Alzahrani; Mozilla tracks the record as bug 2067465. In NVD’s CVSS 3.1 assessment, the vulnerability appears at a critical level with a score of 9.8 and does not require user interaction or prior privileges for exploitation. In the SSVC assessment coordinated by CISA, however, there is no indication that the vulnerability is being actively exploited.

The change introduced with Firefox 157.0.1

Mozilla reiterates in the advisory that it has changed the way it publishes advisories: the company now publishes a separate advisory and a separate CVE number for every security bug it finds. Therefore, even a single point release can be listed with a single CVE. Version 157.0.1 was announced on October 6 as the point release update to the Firefox 157 series. In this release, Mozilla only fixes the vulnerability above; no other security fix is mentioned in the release notes.

How to update

Firefox updates are downloaded in the background by default. To check the version, you can open Help and About Firefox from the browser menu; this screen checks for updates immediately and downloads them if available. In enterprise environments, those using the extended support release (ESR) channel are advised to check the release schedule with their administrators. After the update is complete, you can verify on the About Firefox screen that the version number is 157.0.1.

Source: Mozilla · NVD