THE CRUNCH
Google and Mozilla on Tuesday shipped fresh browser updates that together resolve more than 200 vulnerabilities. Chrome 156 arrives with patches for 52 security defects, four of them rated critical, while Firefox 159 carries 167 fixes, including 108 high-severity flaws.
The critical Chrome flaws include memory corruption in FileSystem, improper input validation in FileAPI and Skia, and a use-after-free in Layout. The FileSystem bug, tracked as CVE-2026-118306, could let arbitrary code run outside the browser's sandbox through a crafted HTML page. Another 46 high-severity Chrome bugs were patched, mostly memory corruption, input validation and use-after-free issues.
Firefox 159's fixes are mostly for use-after-free bugs, alongside sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass issues. Mozilla also released Thunderbird 159 and 153.6, plus Firefox ESR 153.6 and 115.44, with patches for many of the same flaws.
Neither company mentions any of the bugs being exploited in the wild, but users are advised to update as soon as possible. Chrome 156 is rolling out as versions 156.0.8078.73/.74 on Windows and macOS and 156.0.8078.73 on Linux.