Chrome and Firefox updates fix more than 200 security flaws

Google and Mozilla released updates to patch more than 200 vulnerabilities in their browsers, with Chrome 156 and Firefox 159 leading the fixes. SecurityWeek reports that Chrome 156 includes patches for 52 security defects, four of which are critical. A notable fixed flaw is CVE-2026-118306, a FileSystem bug that could allow arbitrary code execution outside the browser sandbox via a crafted HTML page.

The Chrome release also addresses 46 high‑severity defects, most of which relate to memory corruption, improper input validation, or use‑after‑free issues. Chrome updates are rolling out as version 156.0.8078.73/ .74 for Windows and macOS, and 156.0.8078.73 for Linux. SecurityWeek notes that Google did not award bug bounties for the reported vulnerabilities, and that 39 vulnerabilities remain without a reward, largely discovered internally or with AI assistance.

Firefox 159, meanwhile, patches 167 security defects, including 108 high‑severity flaws. The majority of fixes address use‑after‑free conditions, with additional patches for sandbox escapes, privilege escalation, incorrect boundary checks, and same‑origin policy bypasses. Mozilla also released Thunderbird 159 and 153.6, and Firefox ESR 153.6 and 115.44, to address many of these vulnerabilities.

Both Google and Mozilla state that there is no evidence these flaws have been exploited in the wild, but SecurityWeek stresses that users should update their browsers promptly. The article is authored by Ionut Arghire for SecurityWeek and dated 28 October 2026.