Chrome and Firefox Updates Patch Over 200 Vulnerabilities

What it is

Google and Mozilla shipped Chrome 156 and Firefox 159 on a Tuesday, together fixing more than 200 vulnerabilities. Neither vendor reports exploitation in the wild. The page adds the full list of Chrome's critical flaws, the exact build numbers, and the Mozilla release trains that received backports.

Preconditions / Affected

Chrome's four critical flaws are:

• Memory corruption in FileSystem (CVE-2026-118306).
• Improper input validation in FileAPI.
• Improper input validation in Skia.
• Use-after-free in Layout.

CVE-2026-118306 could allow arbitrary code execution outside the sandbox through a crafted HTML page. Chrome also received 46 high-severity fixes, mostly memory corruption, improper input validation and use-after-free.

Firefox 159 fixes 167 flaws, 108 of them high severity. Most are use-after-free. Mozilla also patched multiple sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass issues.

What to do

Update to these builds:

• Chrome 156.0.8078.73 or .74 on Windows and macOS, and 156.0.8078.73 on Linux. The release is rolling out gradually.
• Firefox 159.
• Thunderbird 159 or 153.6.
• Firefox ESR 153.6 or 115.44, depending on the ESR line in use.

The page says many, not all, of the Firefox fixes reached Thunderbird and the ESR releases. It does not say which ones.

Caveats

• The page gives no CVE ids for the other three critical Chrome bugs or for any Firefox bug.
• Google had not set bounty amounts at publication. No reward will be paid for 39 of the Chrome vulnerabilities, most of which were found internally or with AI assistance.
• The page advises updating as soon as possible but gives no mitigation for users who cannot update.