Chrome 156 and Firefox 159 Patch Dozens of Security Flaws Across Both Browsers
Neither vendor reports the bugs being exploited in the wild, but users should update promptly.
Google shipped Chrome 156 with fixes for 52 security defects, four of them critical, including CVE-2026-118306, a FileSystem memory-corruption bug that could allow code execution outside the sandbox via a crafted HTML page. The release also patches 46 high-severity bugs, and the new builds are rolling out as 156.0.8078.73/.74 on Windows and macOS and 156.0.8078.73 on Linux. Most of the remaining 39 vulnerabilities were found internally or with AI assistance, so no bounty will be paid for them. Mozilla released Firefox 159 with 167 security fixes, 108 of them high-severity, mostly use-after-free issues plus sandbox escape and same-origin policy bypass flaws. Thunderbird 159 and 153.6 and Firefox ESR 153.6 and 115.44 also received patches, and neither vendor reports the bugs being exploited in the wild, but users should update promptly.
Why it matters
For ordinary users, the practical change is that both browsers now carry fixes for serious flaws, including critical bugs in Chrome that could allow code execution outside the sandbox through a crafted HTML page. Firefox's fixes cover mostly use-after-free issues along with sandbox escape and same-origin policy bypass flaws. Because the Chrome bugs were largely found internally or with AI assistance, no bounty will be paid for the remaining 39 vulnerabilities, which means the usual outside research pipeline did not produce most of these fixes.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.