Google and Mozilla ship Chrome and Firefox security updates

Google and Mozilla shipped security updates for the Chrome and Firefox browsers on Oct. 27, 2026, patching serious vulnerabilities in both. The updates fix critical and high-severity memory flaws in both browsers.

Chrome’s desktop update reaches version 156.0.8078.73/.74 on Windows and Mac, and 156.0.8078.73 on Linux. It includes 52 security fixes, four of them rated Critical. The Chrome update also addresses 46 high-severity defects, chiefly memory corruption, improper input validation, and use-after-free issues.

Critical flaws in Chrome include memory corruption in FileSystem, a use-after-free in Layout, and input validation errors involving FileAPI and Skia. CVE-2026-118306 covers the FileSystem flaw, which could allow arbitrary code execution outside the sandbox from a crafted HTML page. Neither vendor mentions exploitation in the wild, and both urge users to update immediately.

Mozilla issued Security Advisory 2026-118 for Firefox 159, covering 167 vulnerabilities. It addresses 108 flaws rated high severity, 52 medium-risk vulnerabilities, and seven vulnerabilities rated low risk. It includes 97 use-after-free flaws, several of which may enable code injection and execution, and 13 flaws can enable sandbox escape.

Firefox 159 also patches same-origin policy bypasses, incorrect boundary issues, privilege escalation flaws, and multiple sandbox escape flaws. The two updates also fix use-after-free vulnerabilities in page layout, JavaScript processing, and SVG graphics. In a use-after-free, a program accesses freed memory, which can crash it or let an attacker run code.

Mozilla also shipped Thunderbird 159 and 153.6 and Firefox ESR 153.6 and 115.44, patching many of these vulnerabilities. Firefox ESR 153.6.0 covers 145 vulnerabilities, and Firefox ESR 115.44.0 covers 80.

Firefox 159 runs on Windows, macOS, Linux, and Android. Both updates reach users gradually over days and weeks.

Google and Mozilla credit OpenAI Codex Security with finding bugs fixed in these releases. Mozilla says external researchers reported 65 of the 167 Firefox flaws, including seven from Amy Burnett at OpenAI. Google will pay nothing for 39 vulnerabilities discovered internally or with AI and has not set bug bounty rewards for reporting researchers.

Firefox 159 adds a sidebar password tool enabled by default plus an AI-assisted Smart Window feature that monitors website changes. Firefox 160 is planned for Nov. 10, 2026.

To update Chrome manually, open About Google Chrome via settings or Help, then click Relaunch. For Firefox, open the Help menu, select About Firefox, and click Relaunch after the download completes.