Google and Mozilla on Tuesday rolled out fresh Chrome and Firefox updates that resolve more than 200 vulnerabilities in the popular browsers.
The Chrome 156 update arrives with patches for 52 security defects, including four critical-severity flaws: memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout.
CVE-2026-118306, the FileSystem bug, could allow arbitrary code execution outside the sandbox through a crafted HTML page.
Patches were also released for 46 high-severity bugs, most of which are memory corruption, improper input validation, and use-after-free issues.
Google has not determined any of the bug bounty rewards to be paid out to the reporting researchers. No reward will be handed out for the remaining 39 vulnerabilities, most of which were found internally or with the aid of AI.
The new Chrome release is now rolling out to users as versions 156.0.8078.73/.74 for Windows and macOS, and as version 156.0.8078.73 for Linux.
Mozilla announced the release of Firefox 159 with patches for 167 security defects, including 108 high-severity flaws.
Most of the fixes resolve use-after-free issues in the browser. Multiple sandbox escape, privilege escalation, incorrect boundary, and same-origin policy bypass issues were also patched.
On Tuesday, Mozilla also released Thunderbird 159 and 153.6, and Firefox ESR 153.6 and 115.44 with patches for many of these vulnerabilities.
Google and Mozilla make no mention of any of these security bugs being exploited in the wild, but users are advised to update their browsers as soon as possible.
Related: TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
Related: China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Related: HPE Patches Dozens of Critical Flaws in Networking Products
Related: Attackers Exploit Third Arista VCO Zero-Day in Four Months
