Google and Mozilla released Chrome 156 and Firefox 159 on October 27, addressing more than 200 security vulnerabilities. Chrome’s update includes four critical flaws, while Firefox’s fixes cover sandbox escapes and other weaknesses, according to SecurityWeek. Neither vendor mentioned exploitation in the wild, the publication reported.
Google’s release bulletin lists 52 security fixes: four rated critical, 46 high and two medium. The critical vulnerabilities are memory corruption in FileSystem, tracked as CVE-2026-118306; improper input validation in FileAPI and Skia, tracked as CVE-2026-118331 and CVE-2026-118348; and a use-after-free flaw in Layout, CVE-2026-118344.
According to SecurityWeek, CVE-2026-118306 could allow arbitrary code execution outside Chrome’s sandbox through a crafted HTML page. That describes a potential exploitation path, rather than an observed attack.
The patched Chrome builds are rolling out as versions 156.0.8078.73 and 156.0.8078.74 for Windows and macOS, and 156.0.8078.73 for Linux, SecurityWeek reported. Google says access to some bug details may remain restricted until most users have received fixes, or while other projects using an affected third-party library remain unpatched.
Firefox 159 addresses 167 security defects, including 108 rated high, according to SecurityWeek’s account of Mozilla’s announcement. Most fixes concern use-after-free flaws, which involve software accessing memory after it has been released. The update also addresses sandbox escapes, privilege escalation, incorrect boundary issues and same-origin policy bypasses—the latter involving restrictions that separate content from different web origins.
Mozilla also released Firefox ESR 153.6 and 115.44, alongside Thunderbird 159 and 153.6, on October 27. SecurityWeek reported that these releases fix many of the same vulnerabilities; the Firefox 159 total should not be treated as the fix count for each of those separate releases.
