Chrome 156 and Firefox 159 Fix a Combined 219 Security Flaws
Google and Mozilla have released security updates for Chrome and Firefox. Together, they address 219 vulnerabilities, including critical flaws in Chrome.
Chrome 156 and Firefox 159 deliver extensive security fixes. Google and Mozilla released the updates on October 27, 2026; together, they address 219 vulnerabilities in two widely used web browsers.
Chrome 156 and Firefox 159: Fix Counts
Stable Chrome version 156.0.8078.73/.74 is available for Windows and macOS, while Linux is receiving version 156.0.8078.73. Google said the update will also be gradually distributed for Android.
Chrome fixes 52 security flaws, four of which Google classified as critical. The manufacturer has not yet disclosed some technical details. It uses this approach until the update has been distributed among users.
In advisory MFSA 2026-118, Mozilla lists a total of 167 fixed vulnerabilities for Firefox 159. It rates the advisory’s overall impact as high. The combined number of fixes in both releases therefore exceeds 200.
What Firefox 159 Addresses
The classes of flaws fixed in Firefox include same-origin policy bypasses, sandbox escapes, privilege escalations, and use-after-free bugs. If successfully exploited, similar weaknesses could lead, for example, to data leaks, compromised website isolation, or higher privileges being obtained.
The same-origin policy is a core browser security mechanism that restricts scripts from one website from accessing data from another website. The sandbox isolates browser processes and their contents from the rest of the system.
Updates Are Available, Chrome Deployment Continues
Neither Google nor Mozilla states in the reviewed announcements that any of the flaws fixed in these specific releases have been confirmed as actively exploited. However, this does not mean that information about possible exploitation cannot emerge later.
Users should check whether they are running current versions of Chrome 156 or Firefox 159. Corporate device administrators should also monitor update deployment on managed workstations. For Firefox, the supported ESR release is also relevant.
With Chrome, users should expect a gradual rollout, including on Android. Google may later add technical information about some flaws after the update reaches a larger number of users. Both companies may also issue follow-up fixes if regressions or new vulnerability details emerge after deployment.
Sources
- Google Chrome Releases – Confirms the release of Chrome 156.0.8078.73/.74 on October 27, 2026, the gradual rollout, and 52 security fixes, including four critical flaws.
- Mozilla Foundation Security Advisory 2026-118 – Confirms the release of Firefox 159 on October 27, 2026, the advisory’s overall high impact, and the individual fixed flaws, including sandbox escape, privilege escalation, and use-after-free.
- SecurityWeek – Corroborates the count of 52 fixes in Chrome and 167 in Firefox, totaling more than 200.
Verified and updated: October 28, 2026, 15:29
