Chrome 156 and Firefox 159 updates patch more than 200 vulnerabilities

Google and Mozilla have released new versions of their web browsers that together patch more than 200 security vulnerabilities, including critical flaws in Chrome that could let an attacker break out of the browser's protective sandbox. SecurityWeek reported the updates on October 28, 2026, noting that the releases went out the previous day.

What happened

Google shipped Chrome 156 (version 156.0.8078.73/.74 for Windows and macOS and 156.0.8078.73 for Linux), while Mozilla released Firefox 159. According to SecurityWeek, Chrome 156 resolves 52 security defects and Firefox 159 fixes 167, for a combined total above 200. Neither vendor has reported that any of the flaws are being exploited in the wild, and SecurityWeek advises users to update as soon as possible.

Technical details

SecurityWeek reports that Chrome 156 includes four critical-severity fixes, covering memory corruption in the FileSystem component, improper input validation in FileAPI and Skia, and a use-after-free flaw in Layout. The most notable of these, CVE-2026-118306 in FileSystem, could allow arbitrary code execution outside the sandbox through a crafted HTML page. Google has not finalized bug bounty rewards for the reported issues, and the article says most of the remaining bugs were found internally or with the help of automated tooling.

On the Firefox side, Mozilla's 159 release addresses 167 security defects, 108 of them rated high severity. SecurityWeek says the flaws are mostly use-after-free issues, but the set also includes sandbox escape, privilege escalation, incorrect boundary conditions and same-origin policy bypass problems. The article does not list individual Firefox CVE identifiers or bounty amounts.

Who is affected

The updates matter to the very large base of desktop users running Chrome and Firefox on Windows, macOS and Linux. Because several of the flaws could lead to code execution or let a malicious page escape browser isolation, an unpatched browser visiting a crafted page remains the core risk. Mozilla also issued Thunderbird 159 and 153.6 and Firefox ESR 153.6 and 115.44 on the same day, extending the fixes to its mail client and extended-support releases.

What to do

Users should update Chrome to version 156 and Firefox to 159 — or the corresponding ESR builds — as soon as the updates are offered. Chrome typically updates automatically but requires a restart to apply, so relaunching the browser ensures the new build is active. Organizations that manage browsers centrally should push the releases to managed fleets, and Thunderbird users should move to the patched 159 or 153.6 builds. SecurityWeek stresses prompt patching given the number and severity of the fixed issues.