Updated: 4 November 2026. Firefox 159.0.1, released on 3 November, fixes failed passkey sign-in on websites sharing credentials across related services. Mozilla names Facebook and Instagram as examples. Start by updating and checking the specific failure, not by deleting your passkey. [1]
Which failure does this address?
An existing passkey may still be valid when the browser stops authentication before a device prompt appears. Bug 2085450 concerns related-origin checks; the correction adds Fetch Metadata headers. An early theory about the website's security policy is not a reason to disable protections. Missing credentials and timeouts can have other causes. [2]
Prepare without locking yourself out
Use only your own or an authorised account. Have an already configured alternative sign-in method available, and initially keep a working session open. Back up important browser data: locate the profile through about:support, fully quit Firefox, then copy the folder to protected storage. This does not guarantee a backup of passkeys held by an operating system, password manager or security key. Do not export credentials or send them to support. [4]
Five safe checks
- Record the starting point: Firefox version, operating system, exact website and a sanitised error message. Check that the passkey is available on the intended device or provider. A browser update cannot repair use of the wrong account or a disconnected security key.
- Update through the existing installation channel. For Mozilla installations on Windows/Linux, open Menu → Help → About Firefox; on macOS, Firefox → About Firefox. Opening this window may start a download. Restart and check for 159.0.1 or a newer approved Release version. Linux distribution packages, Microsoft Store installations and managed devices use their package manager or IT-approved process. [3]
- Type the known HTTPS address yourself and select the website's explicit passkey sign-in option. Avoid sign-in links in unsolicited messages and unexpected QR codes. Approve a device prompt only when you initiated this attempt and the displayed service is the intended one.
- If it still fails, distinguish no device prompt, an expired prompt and an error after confirmation. Unlock the device and connect any required security key; make one controlled retry rather than repeated attempts. Mozilla's help page separates these errors for Mozilla accounts; its account-recovery instructions do not automatically apply to Meta. [5]
- Compare the outcome on the same device and service. After access succeeds, verify the account name and expected account page, not merely that an error disappeared. Test a fresh sign-in only once an alternative access method is secure. Do not pre-emptively delete passkeys, reset the profile or disable certificate and website protections.
How to confirm success
Success means the expected device confirmation, access to the correct account and the same result in a controlled repeat test. A version number alone is not proof of successful authentication. If the failure remains, use the provider's supported alternative and report the version, time and sanitised error, without credential material, session data or complete network captures.
Limits, recovery and sources
This guide covers the desktop Release channel. An ESR 153 “fixed” tracker flag alone does not identify a shipped ESR package; Android and iOS require separate release evidence. We have not reproduced the defect ourselves. Recovery means stopping further experiments, preserving working access and backed-up data, and involving IT or the provider. Do not use an old browser as a permanent workaround or restore over a running profile. No shopping or affiliate links.