Google and Mozilla have released major browser security updates that collectively fix 219 vulnerabilities. Chrome 156 patches 52 security defects, while Firefox 159 addresses 167 flaws across the Windows, macOS, Linux and Android browser releases.
Google’s stable-channel update brings Chrome to versions 156.0.8078.73/.74 on Windows and macOS and 156.0.8078.73 on Linux. The Android build uses 156.0.8078.73, with availability rolling out through Google Play. Google lists four of the fixes as critical, including memory corruption in FileSystem, improper input validation in FileAPI and Skia, and a use-after-free vulnerability in Layout.
Google is withholding some technical details while the update reaches a larger share of users, a standard measure intended to reduce the opportunity for reverse engineering and exploitation. The company’s release notice does not report exploitation of the Chrome flaws in the wild, and public CVSS scores were not available for every issue at publication time. Defenders should therefore treat the critical fixes as high-priority browser maintenance rather than wait for exploit code or detailed scoring.
Mozilla’s Firefox 159 security advisory breaks its 167 fixes into 108 high-severity, 52 moderate-severity and seven low-severity vulnerabilities. The release includes multiple memory-safety defects, along with bugs that could enable sandbox escapes, privilege escalation, same-origin policy bypasses and other violations of browser security boundaries. Mozilla reports no critical-rated issue in the release and does not identify an actively exploited vulnerability.
Among the disclosed Firefox issues are CVE-2026-117861, described as a sandbox-escape flaw, and CVE-2026-117860, involving a same-origin policy bypass. NVD records and vendor advisories may be updated as analysis continues, so security teams should monitor both sources for CVSS v3 or v4 assessments and additional affected-product information.
Organizations should accelerate deployment through managed-browser controls, verify that endpoints have moved to the latest vendor-supported builds, and prioritize systems used to access untrusted websites or handle sensitive data. Administrators running Firefox extended-support releases should also review Mozilla’s accompanying MFSA 2026-119 and MFSA 2026-120 advisories for their applicable ESR versions.
