Chrome 156 and Firefox 159 Security Updates: 219 Fixes and How to Check You Are Patched

Google and Mozilla both released browser security updates on Tuesday, October 27, 2026. Chrome 156 fixes 52 security flaws and Firefox 159 fixes 167. Your team uses a browser for email, banking, payroll and every cloud app you pay for, so these are the patches that matter most on your network this week.

There is some good news. Neither company says any of these flaws are being used in attacks right now. Even so, update quickly: once a fix is public, the gap between the patch and the first attacks is usually short.

What happened with Chrome 156

Google's Chrome Releases blog posted a "Stable Channel Update for Desktop" on October 27, 2026. It moves Chrome to version 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, and says the update "includes 52 security fixes."

Here is what we confirmed in Google's own notes:

• The first bug listed is CVE-2026-118306, rated Critical, a memory corruption problem in Chrome's FileSystem component. It was reported to Google on October 7, 2026.
• The update rolls out "over the coming days/weeks", so some computers will not have it yet.
• The release notes do not say that any of the bugs are being exploited in the wild.

What happened with Firefox 159

Mozilla published security advisory MFSA 2026-118 on October 27, 2026, with fixes in Firefox 159. Mozilla rates the advisory's overall impact as High.

Here is what we confirmed in Mozilla's advisory:

• 167 CVEs in total: 108 rated high, 52 moderate and 7 low. None is rated critical.
• Several sandbox escapes, including CVE-2026-117861, CVE-2026-117864 and CVE-2026-117868.
• Several privilege escalation bugs, including CVE-2026-117862 and CVE-2026-117866.
• Several same-origin policy bypasses, including CVE-2026-117860 and CVE-2026-117912.
• Mozilla released fixes on the same day for Firefox ESR 153.6, Firefox ESR 115.44, Thunderbird 159 and Thunderbird 153.6 (advisories MFSA 2026-119 through 2026-122).
• The advisory does not mention any exploitation in the wild.

What is claimed but not confirmed

SecurityWeek, which first reported the story, says four of Chrome's 52 bugs are rated critical and 46 are rated high. We could confirm only one critical bug ourselves, the first entry in Google's list, because we could not read Google's full list. Note that 4 plus 46 makes 50, not 52, so treat those severity counts as a news report, not a confirmed breakdown.

What nobody has said publicly is how easy any of these bugs are to exploit, or whether anyone has a working attack. If that changes, the vendors usually update their notes, and we will cover it on our alerts page.

Why a browser update matters for a business network

For most companies, the browser is the front door to everything. Signed-in sessions for Microsoft 365, Google Workspace, your accounting software, your bank and your website's admin panel all live there. A flaw in the browser can expose all of them at once.

Two terms from Mozilla's list are worth explaining in plain English:

• Sandbox escape: the browser runs each web page inside a locked box so a bad page cannot touch the rest of the computer. A sandbox escape is a way out of that box.
• Same-origin policy bypass: browsers stop one website from reading another website's data. A bypass could let a malicious page read data from a site you are signed in to.

In a business, it only takes one out-of-date laptop. One person on an old version who clicks one bad link can hand over a signed-in session to your email or finance tools. Browsers also do not finish updating until they restart. Chrome can download the update and then wait for days on a laptop that never gets closed. We wrote about that gap in Updated Is Not the Same as Patched.

How to check your Chrome and Firefox version

What to do this week

• Ask everyone to fully close and reopen Chrome and Firefox today, then check the version using the table above.
• If you manage devices centrally, check your management console for computers still on Chrome below 156.0.8078.73 or Firefox below 159.
• Remember the laptops that never get shut down, shared front-desk computers and kiosk machines. These fall behind most often.
• If your organisation uses Firefox ESR, confirm it is on 153.6 or 115.44.
• Update Thunderbird if anyone uses it for email.
• Check Edge, Brave or any other browser your team uses against that vendor's own release notes.
• If your managed devices allow it, set a deadline that forces a browser restart after an update, so updates do not sit waiting.

If you also run servers or other vendor software, the same discipline applies there. See Who Is Patching the Software That Runs Your Business?. Apple users should also be current on the phone side: see our iOS 27.2 security update post.

Chrome 156 and Firefox 159 questions people are asking

Is Chrome 156 fixing an exploited zero-day?

Not according to Google. The October 27 release notes do not report any of the 52 fixed bugs as exploited in the wild.

How many vulnerabilities does Firefox 159 fix?

Mozilla's advisory lists 167: 108 high, 52 moderate and 7 low. None is rated critical.

What is the latest Chrome version?

As of October 27, 2026, it is 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux. If your version is lower, update and relaunch.

Do I need to restart my browser to be protected?

Yes. Chrome and Firefox can download an update in the background, but the fix does not take effect until the browser restarts.

Is Firefox ESR patched too?

Yes. Mozilla released Firefox ESR 153.6 and ESR 115.44 on the same day.

Does this affect Microsoft Edge?

Edge is built on the same open-source code as Chrome, so it often needs related fixes. Check Microsoft's own Edge release notes for its fixed version. We have not confirmed it.

The bigger lesson

Browser updates now arrive every few weeks and carry dozens or even hundreds of fixes. Nobody can judge each bug one by one. What protects a business is a routine: updates install automatically, browsers restart on a deadline, and someone checks that every machine actually landed on the fixed version. A patch that has been released but never applied to your computers does not protect you.

Want help building that routine? See our security hardening services or request a quote.

Get security alerts by email, plus our free checklist, at /security-alerts.

Sources: Google Chrome Releases: Stable Channel Update for Desktop, October 27, 2026; Mozilla Foundation Security Advisory 2026-118; Mozilla Security Advisories index; SecurityWeek.